This vulnerability is an incorrect access control flaw in the setWizardCfg function. An attacker who can reach the router’s web interface can send a crafted POST request to /cgi-bin/cstecgi.cgi and change WAN, Wi‑Fi, and device initialization settings. The changes can disrupt network connectivity, expose the device to hostile networks, or reset security settings, thereby undermining confidentiality, integrity, and availability of the device and connected devices.

The flaw exists in TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. No other product versions are listed.

Because authentication is not required, any host that can access the device over the network can potentially exploit the flaw. The exploit requires only sending a POST request and does not need special privileges. No CVSS or EPSS scores are available, and the issue is not listed in the CISA KEV catalog, but the remote, unauthenticated nature and the ability to change core networking settings indicate a high likelihood of abuse and a severe impact if targeted.