The setScheduleCfg function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 implements access control incorrectly, enabling any network user to send a crafted POST request to /cgi-bin/cstecgi.cgi and configure forced reboot tasks. This flaw can be exploited by unauthenticated attackers, allowing them to initiate scheduled reboots without authorization. The affected code handles the request with insufficient privilege checks, directly writing reboot configuration values.

Devices impacted are TOTOLINK T6 routers running the specific firmware build 4.1.5cu.748_B20211015. No other firmware versions are listed, and the issue may exist only on this build, but the absence of further data creates uncertainty. The vulnerability was identified through documentation and vendor coordination resources for TOTOLINK.

The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 9.8 signals critical severity for unauthenticated forced reboot. The likely attack vector is remote over the network, allowing any unauthenticated user to craft a POST request to /cgi-bin/cstecgi.cgi and schedule reboots. In environments where the router is exposed to untrusted networks, this creates a high denial-of-service risk, potentially interrupting critical services.