A critical access control flaw in TOTOLINK T6 routers allows unauthenticated remote attackers to modify critical network configuration settings, posing a severe risk to network integrity.

The vulnerability exists within the setWanCfg function, which fails to perform proper authentication checks. This allows an unauthenticated remote attacker to send a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to alter upstream provisioning and connectivity settings.

The ability for an unauthenticated attacker to modify WAN settings allows for full control over the network traffic path, potentially facilitating man-in-the-middle attacks, traffic redirection, or permanent loss of internet connectivity. Given the CVSS score of 9.1, this vulnerability represents a critical threat to organizational network infrastructure and communication security.

Immediate Action: Review vendor documentation at the provided TOTOLINK support link to determine if a firmware update is available for the T6 model. If no official patch is available, isolate the device management interface from the public internet immediately.

Proactive Monitoring: Monitor network gateway logs for suspicious POST requests targeting the /cgi-bin/cstecgi.cgi endpoint. Look for unusual traffic patterns originating from external IP addresses that coincide with unauthorized changes to WAN settings.

Compensating Controls: Implement a strict firewall policy that blocks external access to the router management interface. Restrict administrative access to a trusted internal management VLAN or a specific jump host to prevent unauthorized remote interaction.

Public Exploit Available: Yes — published proof-of-concept exists (referenced via GitHub research write-ups).

Due to the critical nature of this vulnerability and the potential for total loss of control over network connectivity, administrators must treat this as a high-priority item. If a firmware update is not currently available, administrators should prioritize network segmentation or firewall rules to restrict access to the device management interface until a verified patch can be applied.