A critical access control vulnerability in the TOTOLINK T6 router allows unauthenticated remote attackers to manipulate network filtering rules, posing a severe risk to network integrity.

The device fails to perform proper authentication checks within the setUrlFilterRules function, which is reachable via the cstecgi.cgi interface. Unauthenticated remote attackers can exploit this by sending a specifically crafted POST request to alter the device browsing policies.

The vulnerability carries a CVSS score of 9.1, indicating a critical severity level due to the ease of remote exploitation without authentication. Successful exploitation allows unauthorized modification of security policies, which could be leveraged to bypass content filtering, redirect traffic, or facilitate man-in-the-middle attacks against connected clients. This poses a significant risk to organizational data security and network trust.

Immediate Action: Consult the official TOTOLINK support portal for firmware updates addressing this vulnerability, as no public patch version is currently confirmed. If an update is unavailable, restrict management access to the device to trusted internal networks only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the cstecgi.cgi endpoint, particularly those originating from untrusted or external IP addresses.

Compensating Controls: Implement strict network perimeter controls, such as disabling remote management features on the router and utilizing a firewall to block unauthorized access to the web management interface.

Public Exploit Available: Unknown.

Given the critical nature of this access control failure and the potential for complete manipulation of network browsing policies, administrators must prioritize restricting access to the router management interface immediately. Until the vendor provides a validated firmware patch, the device should be considered compromised if reachable from an untrusted network.