The vulnerability resides in an incorrect access control check within the setUploadSetting function of the TOTOLINK T6 firmware 4.1.5cu.748_B20211015. Because the function does not verify authentication, an attacker can issue a crafted POST request to /cgi-bin/cstecgi.cgi and manipulate the upload or flash workflow. This flaw enables the insertion of arbitrary files to the router, potentially leading to replacement of firmware or execution of malicious code, thereby compromising the device’s integrity and availability. The weakness is an example of CWE‑284, Improper Access Control.

TOTOLINK T6 devices running the firmware build 4.1.5cu.748_B20211015 are affected. No other versions or models are explicitly enumerated in the advisory.

The vulnerability can be triggered remotely over the network when an attacker can reach the device’s web interface; this is the likely attack vector, inferred from the use of an HTTP POST endpoint. The EPSS score is < 1%, indicating a very low probability of exploitation. Because no authentication is required, the barrier to exploitation is low, and the impact is high due to potential arbitrary firmware manipulation. The CVSS score of 9.8 confirms the severity as critical. However, the low EPSS score indicates that exploitation is unlikely under typical network exposure.