A critical access control vulnerability in TOTOLINK T6 routers allows unauthenticated attackers to manipulate system configurations, posing a high risk to network management security.

This vulnerability resides in the FirmwareUpgrade function and is triggered by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The flaw allows unauthenticated attackers to bypass security controls and remove Wi-Fi schedule entries.

The exploitation of this vulnerability permits unauthorized modification of router settings, which can be leveraged to disrupt wireless network availability or facilitate further network intrusions. Given the CVSS score of 9.8, this flaw represents a severe risk to operational continuity and network integrity, as it allows for trivial, unauthenticated remote exploitation.

Immediate Action: Consult the official TOTOLINK support portal to determine if a firmware update addressing this specific access control flaw is available for the T6 model. If no update exists, restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor network traffic for suspicious POST requests targeting the /cgi-bin/cstecgi.cgi endpoint. Review device logs for unauthorized changes to Wi-Fi scheduling or configuration parameters.

Compensating Controls: Implement a firewall rule to block external access to the device management interface. Ensure the router is not exposed directly to the public internet.

Public Exploit Available: No

Due to the critical severity of this vulnerability, organizations using the TOTOLINK T6 should prioritize securing the device management interface immediately. Until a vendor-supplied patch is identified and applied, limiting administrative access to authorized local networks is the most effective method to mitigate the risk of unauthorized configuration changes.