TOTOLINK T6 EUVD-2026-68634

Exploitation requires network reachability to the router's HTTP management endpoint /cgi-bin/cstecgi.cgi and the ability to send a POST request invoking the delMacFilterRules function; no credentials, tokens, or user interaction are needed (CVSS PR:N/UI:N). The concrete prerequisite is that the target is a TOTOLINK T6 on firmware 4.1.5cu.748_B20211015 whose web interface is reachable from the attacker's position. Limiting factors: by default the admin interface is LAN-only, so a remote internet attacker generally needs the router to have WAN-side administration enabled/exposed; the impact is confined to MAC-filter configuration, so devices are only actually admitted if MAC filtering was the control gating them and no stronger authentication (WPA key) is in place.

The signals conflict. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) implies a devastating unauthenticated network attack, but the actual described impact - removing MAC filter rules - is a configuration-integrity change, not confidentiality or availability compromise, so the C:H/A:H components appear overstated. EPSS is only 0.16% (6th percentile), there is no KEV listing and no public POC, indicating no observed or predicted mass exploitation. The realistic risk is a targeted weakening of a defense-in-depth control on an internet-of-things/SOHO device, most impactful when the management interface is exposed to a wider network (e.g. WAN-facing or a shared LAN). Priority should be treated as moderate rather than critical: genuinely unauthenticated and trivially automatable, but low real-world exploitation probability and limited direct impact. Note the CVSS-vs-description impact mismatch - verify the true impact before treating this as a 9.8.

An attacker with access to the router's management network (or to a WAN-exposed admin interface) sends a single crafted, unauthenticated POST request to /cgi-bin/cstecgi.cgi invoking delMacFilterRules, wiping the router's MAC filter list. With filtering removed, a device the administrator had blocked - or an attacker-controlled device - can now associate and reach the LAN. No public POC is currently known, but the low attack complexity makes a working exploit trivial to script.