The vulnerability lies in an incorrect access control check within the setLedCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An attacker that can reach the device over the network can craft a POST request to the /cgi-bin/cstecgi.cgi endpoint and modify the LED behavior. This flaw does not directly lead to code execution or data exfiltration, but it allows an unauthenticated actor to alter a device configuration, potentially disrupting visibility or signalling mechanisms of the appliance.

TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015 are impacted. No other vendor or product variants were listed in the available data.

The CVSS score of 9.1 indicates a high severity vulnerability. EPSS is not available, so the exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, indicating no publicly known exploit. The likely attack vector is an unauthenticated HTTP POST request to the device's web interface, as the description mentions a crafted POST to /cgi-bin/cstecgi.cgi. Because the service accepts unauthenticated requests, any device exposed to the network is at risk. The impact is limited to manipulating LED configuration, which can disrupt visibility or signalling but does not provide code execution or data exfiltration.