The vulnerability lies in the setWiFiMeshConfig function of the TOTOLINK T6. An attacker can provide a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint without authentication, allowing them to alter router mesh settings. This change in configuration can disrupt network connectivity and potentially expose or isolate network segments. The flaw is a classic access‑control issue that defeats the device’s authorization mechanisms.

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 is affected. No other versions are listed in the CVE data.

The attack vector requires network access to the device and does not require prior authentication. An attacker can simply send a POST request, so the exploitation is straightforward. The CVSS score of 4.3, alongside an EPSS score of < 1%, indicates moderate severity and very low but non‑zero exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog.