A critical access control flaw in TOTOLINK T6 routers allows unauthenticated remote attackers to manipulate port forwarding rules and expose internal network services to the public internet.

This vulnerability resides in the setPortForwardRules function, which fails to perform proper authentication checks. An unauthenticated attacker can send a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to modify network configuration and bypass security boundaries.

The ability for an unauthenticated attacker to arbitrarily modify port forwarding rules poses a severe risk to organizational network integrity. By exposing internal services that were intended to remain private, an attacker could facilitate unauthorized access to sensitive internal applications, data, or administrative interfaces. Given the CVSS score of 9.8, this vulnerability is classified as critical and represents a significant risk of full system compromise.

Immediate Action: Organizations should restrict access to the web management interface of the affected TOTOLINK T6 devices to trusted management networks only. If a firmware update is released by the manufacturer, apply it immediately to address the underlying access control logic failure.

Proactive Monitoring: Monitor firewall and network logs for suspicious POST requests directed at the /cgi-bin/cstecgi.cgi endpoint. Unusual spikes in traffic or modifications to port forwarding configurations should be investigated as potential indicators of exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rules configured to block unauthorized POST requests to the vulnerable CGI script. Ensure that the device management interface is not exposed to the public internet.

Public Exploit Available: No — there is no confirmed public exploit available.

Due to the critical nature of this vulnerability and the potential for full network exposure, immediate risk mitigation is required. Administrators should prioritize isolating affected devices from external networks until a vendor-supplied patch is identified and verified. Failure to secure these devices could allow adversaries to bypass perimeter security and gain persistent access to the internal environment.