A critical access control vulnerability in the TOTOLINK T6 router allows unauthenticated attackers to modify system configurations, posing a significant risk to device integrity.

The vulnerability exists within the setLedCfg function, which fails to enforce proper authentication checks for incoming requests. Unauthenticated remote attackers can leverage this by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to alter LED behavior.

The exploitation of this vulnerability allows unauthorized modification of device settings, which could be used as a precursor to more complex attacks or to disrupt operations. With a CVSS score of 9.1, the flaw is classified as critical because it is remotely exploitable without authentication, potentially allowing an attacker to gain control over device configuration aspects. Such unauthorized access undermines the security posture of the network infrastructure.

Immediate Action: Contact the vendor or monitor official support channels for the release of a firmware update that addresses this access control deficiency.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /cgi-bin/cstecgi.cgi, particularly those originating from untrusted or external IP addresses.

Compensating Controls: Implement strict network segmentation and firewall rules to ensure the web management interface of the router is not accessible from the public internet.

Public Exploit Available: No

Given the critical severity score and the ease of exploitation, administrators must prioritize restricting access to the administrative interface of the TOTOLINK T6. Ensure that the device is not reachable from the internet and monitor vendor documentation for a firmware patch to resolve the underlying access control logic error.