A critical access control vulnerability in TOTOLINK T6 routers allows unauthenticated attackers to perform unauthorized log deletion, posing a significant risk to system integrity and audit capabilities.

This vulnerability involves incorrect access control within the clearSyslog function. Unauthenticated attackers can trigger this function via a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to erase system logs.

The ability to erase system logs allows an attacker to hide malicious activity, effectively blinding security teams and preventing incident response efforts. Given the critical CVSS score of 9.1, this flaw presents a severe risk to organizational security, as it facilitates unauthorized management of system logs and potentially aids in covering the tracks of more extensive network compromises.

Immediate Action: Check the official TOTOLINK support portal for firmware updates addressing this vulnerability and apply them immediately if available.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed toward /cgi-bin/cstecgi.cgi and review system logs for sudden, unexplained gaps in audit history.

Compensating Controls: Implement access control lists on the network perimeter to restrict access to the device management interface, ensuring that only trusted internal IP addresses can reach the affected CGI endpoint.

Public Exploit Available: Unknown

This vulnerability represents a significant security oversight that compromises the integrity of critical system logs. Organizations using the TOTOLINK T6 should prioritize restricting external access to the device management interface and monitor vendor communications for a definitive patch. Failure to address this could result in an attacker gaining the ability to suppress evidence of unauthorized access within the environment.