A critical access control vulnerability in TOTOLINK T6 routers allows unauthenticated attackers to expose administrative interfaces to the public internet, creating a high risk of unauthorized access.

This flaw exists within the setRemoteCfg function, where insufficient access control permits an unauthenticated attacker to modify device configuration by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.

The ability for an unauthenticated remote attacker to enable WAN-side administration creates a severe security risk, as it bypasses intended network segmentation and exposes the management interface to the public internet. This provides a direct vector for further exploitation, potential credential harvesting, or full device takeover, which justifies the critical CVSS score of 9.1. Such exposure can lead to significant data compromise and total loss of device integrity within the corporate or home network.

Immediate Action: Administrators should immediately restrict access to the web management interface to trusted local IP addresses only and disable WAN-side management access within the device settings.

Proactive Monitoring: Monitor firewall logs and web server access logs for any POST requests directed to /cgi-bin/cstecgi.cgi, particularly those originating from external or untrusted IP addresses.

Compensating Controls: Implement a strict perimeter firewall policy that blocks all inbound traffic to the router management ports (typically 80 or 443) from the WAN interface.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of this vulnerability and the potential for complete exposure of administrative functions, organizations must treat this as a high-priority risk. Immediately audit existing TOTOLINK T6 deployments to ensure remote management features are disabled and verify that the device is not reachable from the internet. Continue to monitor vendor support channels for the release of a firmware update that addresses the underlying access control deficiency.