TOTOLINK T6 EUVD-2026-68540

Exploitation requires network access to the router's HTTP management service and the ability to POST to the /cgi-bin/cstecgi.cgi endpoint invoking the setUPnPCfg function; no authentication, credentials, or user interaction are needed (PR:N/UI:N), and it works against the affected T6 firmware 4.1.5cu.748_B20211015. The primary limiting factor is reachability: by default the management interface is LAN-side, so a remote internet-based attacker needs WAN/remote administration to be enabled, whereas any device already on the LAN can reach it directly. Impact is also scoped to changing the UPnP service state rather than full device takeover, which bounds direct consequences to what enabling UPnP permits.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.1) signals trivial, unauthenticated, low-complexity network exploitation, which is credible for an unauthenticated CGI endpoint. However, the claimed C:H/I:H impact is questionable: the described effect is changing the UPnP service state, which is fundamentally an integrity/configuration change rather than a direct high-confidentiality breach - the C:H rating appears inflated versus the described behavior, so treat the 9.1 as a likely over-scored figure. Real-world urgency signals are otherwise modest: no CISA KEV listing, no POC or exploit code referenced, and no EPSS score provided in the input, so exploitation appears theoretical rather than active. Practical risk is bounded by exposure - the endpoint must be reachable by the attacker (LAN by default; internet-facing only if remote management is exposed) - but the secondary risk is real, since enabling UPnP can let other malicious LAN devices punch NAT holes. Verify the true confidentiality impact against the vendor download-page advisory before treating this as a 9.1-critical priority.

An attacker with network reachability to the router's web interface (a malicious device on the LAN, or the internet if remote management is exposed) sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking setUPnPCfg, with no login required. This flips the UPnP service on, after which the attacker (or other compromised LAN hosts) can request NAT port mappings to expose internal services externally. No public POC is referenced, but the low attack complexity makes reliable exploitation straightforward for anyone who can reach the endpoint.