The setScheduleCfg function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 implements access control incorrectly, enabling any network user to send a crafted POST request to /cgi-bin/cstecgi.cgi and configure forced reboot tasks. This flaw can be exploited by unauthenticated attackers, allowing them to initiate scheduled reboots without authorization. The affected code handles the request with insufficient privilege checks, directly writing reboot configuration values.

Devices impacted are TOTOLINK T6 routers running the specific firmware build 4.1.5cu.748_B20211015. No other firmware versions are listed, and the issue may exist only on this build, but the absence of further data creates uncertainty. The vulnerability was identified through documentation and vendor coordination resources for TOTOLINK.

The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, indicating no known widespread exploitation. However, the attack vector is likely remote over the network, and the flaw offers a straightforward path for unauthenticated attackers to schedule reboots. In environments where the device is exposed to untrusted networks, this creates a high denial‑of‑service risk. Developers and administrators should be aware that the flaw allows creation of tasks that will restart the device, potentially interrupting critical services or causing downtime during mission‑critical periods.