TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the setUPnPCfg function. The flaw allows an unauthenticated attacker to change the UPnP service state by sending a crafted POST request to /cgi-bin/cstecgi.cgi. This grants the attacker the ability to enable or disable UPnP without authorization, potentially exposing the device to further network exploits or allowing indirect access to internal services. The vulnerability is rooted in a flaw in access control mechanisms, matching CWE-284.

The affected product is the TOTOLINK T6 router with firmware build 4.1.5cu.748_B20211015. No other vendors or versions are listed in the CNA data.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw requires only a basic crafted POST request and no authentication, it can be exploited by any host with network reach to the router's web interface. The absence of authentication checks makes exploitation trivial for attackers who can reach the target over the local or remote network. The lack of a CVSS score limits quantitative severity assessment, but the potential impact on network exposure and denial of critical services warrants prompt remediation.