A critical access control vulnerability in TOTOLINK T6 routers enables unauthenticated attackers to manipulate wireless settings and potentially compromise network integrity.

The vulnerability exists in the setWiFiAdvancedCfg function, which fails to perform necessary authentication checks. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to alter wireless behavior.

Successful exploitation of this vulnerability permits unauthorized modification of critical network settings, which can lead to significant service disruption or the degradation of wireless security protocols. Given the CVSS score of 9.1, this flaw is categorized as critical, posing a high risk to network availability and data confidentiality for environments relying on these devices.

Immediate Action: Review the vendor advisory at the official TOTOLINK website for available firmware updates and apply them as soon as they are released for the T6 model.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi and investigate any unauthorized changes to wireless configuration logs.

Compensating Controls: Implement strict firewall rules to restrict access to the web management interface of the router, ensuring it is not exposed to the public internet.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub repositories.

Due to the critical nature of this vulnerability and the ease with which an unauthenticated attacker can manipulate router settings, immediate action is required. Organizations using the TOTOLINK T6 device should prioritize isolating the management interface from untrusted networks and applying the latest firmware updates provided by the vendor to fully mitigate this risk.