An incorrect access control check in the setApWiFiSchCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows an unauthenticated attacker to modify the device’s wireless availability windows by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability is classified as a CWE‑284 (Improper Access Control) weakness and results in the ability to enable, disable, or reschedule Wi‑Fi availability, effectively denying wireless connectivity to users who rely on the network.

This flaw affects the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. No other products, vendors, or firmware versions were explicitly listed as impacted in the advisory.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack requires the ability to reach the router’s web interface to issue a POST request to /cgi-bin/cstecgi.cgi; whether this is possible locally on the device’s network or remotely depends on how the device is exposed. This inference is not directly stated in the input and is derived from the description of the exposed endpoint.