A critical access control vulnerability in TOTOLINK T6 routers allows unauthenticated remote attackers to modify device policies, posing a significant risk to network security.

The vulnerability exists in the setAccessDeviceCfg function, which fails to perform necessary authentication checks. This allows an unauthenticated attacker to inject malicious policies by sending a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint.

This flaw permits unauthorized modification of router access policies, which could be leveraged to bypass security controls, intercept traffic, or redirect network requests. Given the CVSS score of 9.1, this is classified as a critical risk that could lead to full compromise of network access management. Successful exploitation may result in unauthorized data access or total loss of network integrity.

Immediate Action: Consult the official TOTOLINK support portal for available firmware updates addressing this flaw in the T6 model. If a patch is not yet available, restrict access to the web management interface to trusted internal networks only.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /cgi-bin/cstecgi.cgi, particularly those originating from untrusted or external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to inspect and block suspicious POST requests targeting the identified CGI endpoint.

Public Exploit Available: No.

Due to the critical nature of this vulnerability and the absence of authentication requirements, immediate action is required to secure the device management interface. Administrators should prioritize firmware updates as soon as they are released by the vendor and implement strict network segmentation to prevent external access to the vulnerable CGI endpoint.