The vulnerability arises from incorrect access control (CWE-284) in the web management interface of T3 Technology CPE devices. An attacker who can send a crafted request to a vulnerable CGI component can enable the Telnet service without authentication, effectively creating a new management channel.

The affected products are T3 Technology CPE models T625Pro firmware v1.0.07, T6825G firmware v1.0.03, and T7281 firmware v1.0.03. No other models or firmware versions are stated as susceptible.

The flaw is publicly rated CVSS 9.8, placing it in the critical range, and its EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation. Because the vulnerability is not included in CISA KEV, no widespread exploitation campaigns are reported. The attack can be executed remotely over the network when the web interface is reachable and a crafted request can be sent to the CGI component. By enabling Telnet, an attacker obtains a privileged management channel that can be leveraged for further unauthorized actions.