A critical access control vulnerability in the TOTOLINK T6 router allows unauthenticated attackers to manipulate network configurations, potentially disrupting network traffic and connectivity.

This vulnerability resides in the delVlanCfg function of the device management software. It permits an unauthenticated attacker to remove VLAN entries by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.

Successful exploitation allows an attacker to alter VLAN settings without authentication, which can lead to significant network segmentation failures, unauthorized traffic routing, or denial of service for connected clients. Given the CVSS score of 9.1, this vulnerability poses a severe risk to organizational network integrity and operational continuity. Unauthorized modification of network infrastructure can further enable lateral movement or provide a platform for more sophisticated attacks within the target environment.

Immediate Action: Consult the official TOTOLINK support portal for available firmware updates addressing this flaw. If no patch is currently available for your specific unit, restrict access to the web management interface to trusted administrative IP addresses only.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting /cgi-bin/cstecgi.cgi, particularly those originating from untrusted or external network segments.

Compensating Controls: Implement a Web Application Firewall (WAF) or an edge firewall to block direct access to the administrative management interface from public or untrusted networks.

Public Exploit Available: Yes — published proof-of-concept material exists via the referenced GitHub security coordination repositories.

The high CVSS score and the public availability of technical exploit details necessitate immediate attention. Administrators must prioritize isolating vulnerable TOTOLINK T6 devices from the public internet and applying the latest vendor-provided firmware updates as soon as they become available. Failure to restrict administrative access to this device may expose the network to unauthorized configuration changes and potential service disruption.