The setWiFiGuestCfg function in TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 fails to enforce proper access control, allowing an attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi. This flaw enables the attacker to establish or weaken the guest wireless network without authentication, effectively granting unauthorized configuration authority over the device’s guest Wi‑Fi service. The vulnerability is a classic case of incorrect or missing authorization checks (CWE‑284). An attacker who succeeds in modifying the guest network settings could configure the network for illicit purposes such as eavesdropping, distributing malware, or providing a gateway to the internal network. Because the flaw can be triggered through a standard HTTP POST request, an attacker does not need special privileges or knowledge of the device’s internal state, making the attack path relatively straightforward.

TOTOLINK T6 devices running firmware 4.1.5cu.748_B20211015 are vulnerable. No other vendors or product versions are currently documented to be affected by this issue.

The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation in the current timeframe. The vulnerability is not listed in the CISA KEV catalog. The CVSS score of 9.1 demonstrates critical severity, reflecting the ability for an unauthenticated attacker to modify or weaken the guest Wi‑Fi configuration via a simple HTTP POST request to /cgi-bin/cstecgi.cgi. Any device owner with network access to the router can trigger the exploit, exposing the guest network to eavesdropping, malware distribution, or as a stepping‑stone to the internal network.