An unauthenticated remote code execution vulnerability in the TOTOLINK T6 router allows attackers to install and execute custom CGI modules, posing a critical threat to network integrity.

The device suffers from improper access control within the UploadCustomModule function, which does not require authentication. An attacker can exploit this by sending a malicious POST request to the /cgi-bin/cstecgi.cgi endpoint to upload and execute unauthorized code.

This vulnerability carries a CVSS score of 9.1, reflecting its critical severity due to the lack of required authentication and the potential for full system compromise. Successful exploitation allows an attacker to gain persistent unauthorized access to the network device, which could facilitate data interception, internal network pivoting, or complete denial of service for connected users.

Immediate Action: Review the official TOTOLINK support portal for firmware updates addressing this flaw and apply the latest available version immediately. If no patch is available, disconnect the device from the public internet to prevent external exploitation.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi and investigate any unexpected module installations or configuration changes on the device.

Compensating Controls: Implement a strict firewall policy to block external access to the device management interface. If remote management is required, restrict access to authorized VPN connections only.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability and the ease of exploitation via unauthenticated network requests, immediate action is required. Organizations using the affected TOTOLINK T6 hardware must prioritize updating their firmware or restricting network access to the device to prevent unauthorized code execution and complete system takeover.