The vulnerability lies in the setWiFiMeshConfig function of the TOTOLINK T6. An attacker can provide a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint without authentication, allowing them to alter router mesh settings. This change in configuration can disrupt network connectivity and potentially expose or isolate network segments. The flaw is a classic access‑control issue that defeats the device’s authorization mechanisms.

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 is affected. No other versions are listed in the CVE data.

The attack vector requires network access to the device and does not require prior authentication. An attacker can simply send a POST request, so the exploitation is straightforward. The CVSS score is not provided, and the EPSS score is unavailable; the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw permits unauthenticated configuration changes, it presents a significant risk to network stability and security.