A critical access control vulnerability in the TOTOLINK T6 router allows unauthenticated remote attackers to bypass security restrictions and modify device access control lists.

The flaw exists within the setMacFilterRules function, which fails to perform necessary authentication checks. An unauthenticated attacker can exploit this by sending a malicious POST request to the /cgi-bin/cstecgi.cgi endpoint to alter network access configurations.

The ability for an unauthorized party to manipulate MAC filter rules presents a severe security risk to the network perimeter. By modifying these rules, an attacker can permit their own unauthorized devices to access the local network or deny legitimate users access, leading to significant disruption and potential data exfiltration. Given the CVSS score of 9.1, this vulnerability is classified as critical, as it allows full bypass of network access control mechanisms with no required user interaction.

Immediate Action: Review the official TOTOLINK support documentation at the provided vendor link for any available firmware updates or security patches for the T6 model.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi, particularly those originating from untrusted or external IP addresses.

Compensating Controls: If a patch is not yet available, restrict access to the device management interface to trusted internal IP addresses only, or place the device behind a robust firewall that blocks unauthorized access to the web management CGI scripts.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of this flaw and the ease of exploitation, administrators should immediately verify the current firmware version of their TOTOLINK T6 devices. If the device is exposed to the internet, it is highly recommended to isolate the management interface or disable remote administration until a verified firmware update is applied. Failure to remediate this vulnerability may leave the local network infrastructure completely open to unauthorized access and manipulation.