A critical access control flaw in the TOTOLINK T6 router allows unauthenticated attackers to bypass security restrictions and expose internal network resources, posing a severe risk to network integrity.

This vulnerability involves an incorrect access control mechanism within the setDmzCfg function, which fails to validate user privileges. Unauthenticated attackers can trigger this flaw by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to modify DMZ configurations.

The ability for an unauthenticated attacker to reconfigure the DMZ settings of a network device carries significant business risks, including unauthorized exposure of internal servers to the public internet. This bypass of critical security boundaries can lead to full system compromise, data exfiltration, and lateral movement within the corporate network. With a CVSS score of 9.8, this vulnerability is classified as critical due to its ease of exploitation and the potential for total loss of confidentiality, integrity, and availability.

Immediate Action: Review the official TOTOLINK support portal for firmware updates addressing this specific vulnerability and apply them immediately. If no patch is available, isolate the affected device from the public internet.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi, as these may indicate attempts to exploit the DMZ configuration function.

Compensating Controls: Implement strict firewall rules to restrict access to the management interface of the router, ensuring it is not reachable from untrusted networks.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the critical severity of this vulnerability and the potential for complete network exposure, organizations using the TOTOLINK T6 should prioritize this issue in their patch management cycle. Until a vendor-supplied firmware update is verified and installed, administrators must ensure the device is not exposed to the internet to prevent unauthenticated access by malicious actors.