The vulnerability is an incorrect access control in the setPasswordCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015, enabling an unauthenticated attacker to alter the administrator password by sending a crafted POST request to /cgi-bin/cstecgi.cgi. By changing the admin credentials, the attacker can gain full administrative control over the device, compromising confidentiality, integrity, and availability of the network resources connected to it.

The affected devices are TOTOLINK T6 series routers running firmware version 4.1.5cu.748_B20211015. No other vendors or product lines are listed.

Because the flaw allows unauthenticated modification of administrative credentials, the attack vector is remote network access. The exploit does not require user interaction and can be performed by sending a single crafted POST request over HTTP(S). The CVSS score of 9.1 indicates a critical risk, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The lack of mitigation controls makes this a serious threat.