An access control flaw exists in the informSlaveUpdate function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can send an HTTP POST request to /cgi-bin/cstecgi.cgi and trigger mesh slave update coordination without needing authentication. The flaw originates from the function not validating the caller's privileges before forwarding the update command. This is a CWE-284 (Improper Access Control) weakness.

The affected product is TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015. No other vendor or product variants were identified in the current data set.

The EPSS score of <1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, so publicly known exploit activity is unknown. The CVSS score of 9.8 indicates a critical severity. The attack vector is achievable via a standard HTTP POST to the CGI endpoint, which can be performed from any host that can reach the device on the relevant port. Because no authentication is enforced, the technical barrier is low; an attacker only needs network access to the device. The overall risk can be considered high until a patch or mitigation is applied.