An incorrect access control check in the CloudSrvVersionCheck function of TOTOLINK T6 firmware allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi, causing the device to query the cloud for software updates. This bypass of required authorization can be used to repeatedly trigger update checks, potentially exhausting network resources or exposing update metadata. While the vulnerability does not allow direct code execution, it creates a vector for denial of service and could provide attackers insight into the device’s firmware state or update mechanisms.

The flaw is disclosed in TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015. No vendor or vendor product list is formally published, but the affected system is the TOTOLINK T6 device with this specific firmware build.

The CVSS score for this vulnerability is 5.9 and its EPSS score is < 1%; it is not listed in the CISA KEV catalog. The attack requires network access to the device and the ability to craft a POST request to the vulnerable endpoint. Because the function is not protected by authentication checks, the attack is trivial to execute by an unauthenticated actor. Although the impact is limited to service availability and possible information exposure, the official severity rating indicates that organizations should treat it as a risk worth addressing in a timely manner.