A critical access control vulnerability in the TOTOLINK T6 router allows unauthenticated remote attackers to bypass security filters and compromise device integrity.

The vulnerability exists within the setVpnPassCfg function, which fails to perform proper authentication checks. An unauthenticated attacker can execute a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to modify VPN configurations and weaken network edge filtering.

Successful exploitation allows an attacker to bypass critical network security controls, potentially exposing internal resources to unauthorized access or full system compromise. With a CVSS score of 9.8, this flaw represents a severe risk to organizational perimeter security, potentially leading to data exfiltration or the establishment of persistent backdoors within the network.

Immediate Action: Review the official TOTOLINK support site for firmware updates addressing this vulnerability and apply them immediately. If no patch is currently available, prioritize isolating the management interface from the public internet.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi and review system logs for unauthorized configuration changes.

Compensating Controls: Implement a Web Application Firewall or network access control list to restrict access to the management interface to authorized internal IP addresses only.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the critical CVSS severity and the ability for unauthenticated actors to modify security settings, this vulnerability poses a significant threat to network integrity. Administrators must restrict access to the affected device management interfaces immediately and verify firmware versions against the vendor documentation to ensure all available mitigations are in place.