A critical vulnerability in TOTOLINK T6 routers allows unauthenticated remote attackers to cause a denial of service by terminating essential system processes.

The flaw exists within the killProcess function, which lacks proper access control checks. An unauthenticated attacker can exploit this by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to force the termination of critical services.

The ability for an unauthenticated attacker to terminate critical processes presents a severe risk of persistent denial of service, potentially rendering the affected router and its associated network segment completely non-functional. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it can disrupt business operations and impede communication for all devices dependent on the targeted hardware.

Immediate Action: Consult the official TOTOLINK support portal for firmware updates that address this access control flaw, as no specific patch version is currently identified.

Proactive Monitoring: Monitor network traffic for suspicious POST requests targeting the /cgi-bin/cstecgi.cgi endpoint, particularly those originating from untrusted or external IP addresses.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interface, ensuring that the web administration panel is not exposed to the public internet.

Public Exploit Available: No (Exploit status is unknown; no weaponized code or verified public proof-of-concept exists in primary security repositories).

Due to the critical nature of this vulnerability and the ease with which it can be triggered by unauthenticated actors, administrators should treat this as a high-priority incident. Until a vendor-supplied firmware patch is confirmed and applied, access to the device management interface must be isolated from all untrusted networks to prevent potential service disruption.