A critical access control vulnerability in TOTOLINK T6 routers allows unauthenticated attackers to manipulate dynamic DNS configurations, posing a significant risk to network integrity.

This vulnerability involves incorrect access control within the setDdnsCfg function. It permits an unauthenticated attacker to inject malicious changes to the device dynamic DNS state via the /cgi-bin/cstecgi.cgi administrative interface.

The ability for an unauthenticated remote attacker to alter DNS settings on network infrastructure carries severe security implications. By redirecting DNS traffic, an attacker could facilitate man in the middle attacks, redirect users to malicious domains, or bypass security filtering mechanisms, resulting in potential data theft and loss of organizational trust. With a CVSS score of 7.5, this high severity flaw represents a significant threat to network availability and integrity.

Immediate Action: Review the official TOTOLINK support portal for firmware updates addressing this flaw and apply them to all affected T6 devices immediately.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi and review system logs for modifications to DNS settings that were not initiated by authorized administrators.

Compensating Controls: Restrict access to the device web management interface to trusted internal IP addresses only, and implement a firewall rule to block external access to the /cgi-bin/cstecgi.cgi path.

Public Exploit Available: Unknown

Given the ease of access and the potential for network traffic manipulation, this vulnerability should be prioritized for remediation. Administrators must ensure that management interfaces are never exposed to the public internet and should apply the vendor provided firmware update as soon as it becomes available to eliminate the underlying access control deficiency.