A flaw in the access control logic of the RebootSystem function in the TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows an attacker who can send HTTP requests to the device to trigger an immediate reboot. The vulnerability does not allow the attacker to execute arbitrary code, but it can be used to cause denial of service or to disrupt operational continuity by forcing the device to reset.

TotalLink T6 routers running firmware version 4.1.5cu.748_B20211015 are affected. The flaw exists in the web interface component that processes POST requests to the endpoint /cgi-bin/cstecgi.cgi.

The exploitation requires only a crafted POST request and no authentication, so it can be performed by attackers who can reach the router over the network. No CVSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication and the impact of forcing a reboot mean the potential for disruption is high. The EPSS score is not available.