A critical access control flaw in the TOTOLINK T6 router allows unauthenticated remote attackers to manipulate device time settings, posing a significant risk to system integrity.

The vulnerability exists within the NTPSyncWithHost function, which fails to perform proper authentication checks. An unauthenticated attacker can exploit this by sending a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint to alter the device clock.

Successful exploitation allows an attacker to manipulate the device clock, which can be leveraged to bypass time-based security controls, disrupt logging accuracy, or interfere with certificate validation processes. Given the CVSS score of 9.1, this vulnerability is classified as critical due to the ease of exploitation over the network without requiring any prior authentication.

Immediate Action: Consult the TOTOLINK support portal for available firmware updates and apply the latest version immediately to patch the affected function.

Proactive Monitoring: Review web server and access logs for suspicious POST requests targeting the /cgi-bin/cstecgi.cgi endpoint, particularly those originating from untrusted or external IP addresses.

Compensating Controls: Implement strict network access control lists to ensure the management interface of the T6 device is not exposed to the public internet, and utilize a Web Application Firewall to block unauthorized POST requests to the identified CGI script.

Public Exploit Available: No

This vulnerability presents a high risk to network infrastructure due to the lack of required authentication for exploitation. Administrators must prioritize restricting access to the device management interface and should apply vendor-provided firmware updates as soon as they become available to eliminate the underlying flaw.