The vulnerability arises from incorrect access control in the delParentalRules function of TOTOLINK T6 software version 4.1.5cu.748_B20211015, which allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi and delete existing parental‑control rules. This removal undermines the device’s ability to restrict access to content and can expose home networks to unrestricted data access or inappropriate content use. The flaw represents an improper access control weakness that compromises the intended authority structure of the router’s configuration.

Affected systems are TOTOLINK T6 routers running firmware build 4.1.5cu.748_B20211015. No further vendors or product variants are listed.

The flaw can be exploited remotely over the network by anyone who can reach the router’s HTTP interface, requiring no authentication. Because the attack is purely HTTP‑based and does not rely on privileged credentials, the potential impact is significant for environments where parental control is relied upon for safe browsing. The CVSS score of 9.1 is supplied, and EPSS data is < 1%, so the quantified risk is severe but the exploitability probability is low; nevertheless, the openly documented access‑control bypass suggests a high likelihood of exploitation in exposed networks. As the vulnerability is not listed in the CISA KEV catalog, no public remain‑in‑the‑air mitigations are available from the vendor yet.