The flaw is an incorrect access control in TOTOLINK T6's setLanguageCfg routine. An attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi without authentication and alter the router’s language configuration. Changing the language setting can disrupt the user interface and potentially hide other configuration changes, leading to confusion or denial of service.

The vulnerability affects TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015. No other firmware releases are reported as affected, and earlier or later versions are not documented.

The attack vector is inferred as network‑based, using an unauthenticated HTTP endpoint. The CVSS score of 7.5 indicates high severity. With the EPSS score of < 1% and no listing in the CISA KEV catalog, the likelihood of exploitation remains uncertain, but the ability to modify device configuration without credentials provides a valuable foothold for network attackers. The vulnerability could serve as a stepping‑stone to further compromise or to disrupt device operation, though no public exploit is known.