The vulnerability arises from improper access control in the setMacFilterRules function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi and alter the device’s MAC filter rules, effectively bypassing or disabling network access restrictions. This flaw permits unauthorized modification of network access controls, potentially allowing attackers to gain prohibited local network access.

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected. No other vendors or products are listed in the CVE entry.

The exploit does not require any authentication and can be performed remotely over the network. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet, but the absence of defensive measures and the remote nature of the attack place this flaw at a high risk of future exploitation. The CVSS score is 9.1, indicating a high severity impact and serious unauthorized access risk.