This vulnerability is an incorrect access control flaw in the delDevice function, allowing an attacker who can send an HTTP POST request to /cgi-bin/cstecgi.cgi to delete a managed slave device without authentication. The weakness is consistent with CWE-284 and results in loss of service on the affected router, potential data loss from the removed device, and a disruption of the managed network infrastructure.

TOTOLINK network equipment, specifically the T6 router model running firmware version 4.1.5cu.748_B20211015, is affected. The flaw originates in that firmware build as noted in the vendor references.

The exploit requires only network access to the device’s web interface and no user credentials, implying a high abuse potential if the router is exposed to an untrusted network. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, leaving the exact exploitation probability uncertain. However, the lack of authentication and the ability to remove managed devices directly indicates that a remote attacker could potentially cause significant service disruption. The CVSS score of 9.1 indicates critical severity.