An unauthenticated access control vulnerability in the TOTOLINK T6 router enables unauthorized modification of network configurations, posing a high risk to network integrity.

The vulnerability exists within the delPortForwardRules function, which fails to perform necessary authentication checks. This oversight allows any unauthenticated remote attacker to issue crafted POST requests to the cgi-bin/cstecgi.cgi script to delete existing port-forwarding rules.

Successful exploitation results in the unauthorized deletion of port-forwarding rules, which can lead to significant service disruption for legitimate applications relying on inbound traffic. Given the CVSS score of 7.5, this high-severity flaw directly impacts the availability and operational integrity of the network, potentially causing downtime for critical business services or remote access solutions.

Immediate Action: Review the official TOTOLINK support portal for firmware updates addressing this vulnerability and apply them immediately. If no patch is available for your specific unit, isolate the management interface from the public internet.

Proactive Monitoring: Monitor device logs for anomalous POST requests directed at the cgi-bin/cstecgi.cgi endpoint, specifically looking for traffic originating from untrusted or external IP addresses.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interface, ensuring it is only accessible from trusted internal network segments.

Public Exploit Available: No.

This vulnerability presents a significant risk to network availability due to the ease of exploitation. Administrators must prioritize restricting access to the administrative interface of the affected TOTOLINK T6 devices and seek firmware updates from the vendor to remediate the underlying access control logic flaw.