A critical vulnerability in the TOTOLINK T6 router allows unauthenticated remote attackers to bypass security controls by deleting parental rules.

The flaw resides in the delParentalRules function, which lacks proper authentication checks. An unauthenticated attacker can exploit this by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to modify device configuration.

Successful exploitation allows an attacker to disable parental control restrictions, which may expose connected devices to unauthorized content or bypass intended network usage policies. With a CVSS score of 9.1, this vulnerability is considered critical because it permits unauthenticated remote interference with core security settings, potentially compromising the integrity of the home or small office network environment.

Immediate Action: Review the official TOTOLINK support documentation to determine if a firmware update addressing this specific flaw has been released for the T6 model.

Proactive Monitoring: Monitor network logs for unusual POST requests directed at /cgi-bin/cstecgi.cgi, particularly those originating from untrusted or external IP addresses.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses only, and disable remote management features to prevent external access to the vulnerable CGI endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced research repositories on GitHub.

Given the critical severity and the public availability of proof-of-concept code, users of the TOTOLINK T6 should prioritize securing the device immediately. If a patch is not yet available from the vendor, strict network segmentation and the disabling of remote management interfaces are essential to prevent unauthorized access to the device settings.