In the setSyslogCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015, the access control is insufficient, allowing an unauthenticated user to send a crafted POST request to /cgi-bin/cstecgi.cgi and change the device’s logging behavior. This flaw does not enable code execution but allows the attacker to disable, redirect, or otherwise alter log data, thereby erasing audit trails and complicating post‑incident analysis. The lack of authentication barriers makes the vulnerability straightforward to exploit. Based on the description, it is inferred that an attacker could use the modified logs to conceal malicious activity and make detection by network monitoring systems more difficult.

TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015. No other product versions are listed as affected. The attack surface is limited to the web interface handling syslog configuration.

The flaw can be exploited remotely over the network by submitting a POST request to /cgi-bin/cstecgi.cgi with no prior authentication. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Because the attacker can manipulate logging without authentication, an attacker could obscure malicious activity and reduce forensic evidence. The absence of an available CVSS score limits quantitative severity assessment, but the potential to disrupt logging and evade detection presents a significant operational risk.