In the setSyslogCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015, the access control is insufficient, allowing an unauthenticated user to send a crafted POST request to /cgi-bin/cstecgi.cgi and change the device’s logging behavior. This flaw does not enable code execution but allows the attacker to disable, redirect, or otherwise alter log data, thereby erasing audit trails and complicating post‑incident analysis. The lack of authentication barriers makes the vulnerability straightforward to exploit. Based on the description, it is inferred that an attacker could use the modified logs to conceal malicious activity and make detection by network monitoring systems more difficult.

TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015. No other product versions are listed as affected. The attack surface is limited to the web interface handling syslog configuration.

The flaw can be exploited remotely over the network by submitting a POST request to /cgi-bin/cstecgi.cgi with no prior authentication. With an EPSS score of <1% and a CVSS score of 4.3, the vulnerability is considered of moderate severity but is still not listed in the CISA KEV catalog. Because the attacker can manipulate logging without authentication, they could obscure malicious activity and reduce forensic evidence. Although the CVSS score is moderate, the potential to disrupt logging and evade detection presents a significant operational risk.