TOTOLINK T6 EUVD-2026-68637

The target device must be running TOTOLINK T6 firmware 4.1.5cu.748_B20211015. The /cgi-bin/cstecgi.cgi endpoint must be reachable from the attacker - either because the device's management interface is internet-facing, or because the attacker has access to the local network. No authentication, elevated privileges, or user interaction is required. No non-default configuration triggers the vulnerability; the missing access control is present in the default firmware behavior. Exploitation is constrained to network-reachable management interfaces - devices firewalled from untrusted networks are not directly reachable.

The CVSS vector AV:N/AC:H/PR:N/UI:N suggests network-reachable, unauthenticated exploitation but assigns AC:H (high attack complexity), which appears overstated for an attack that requires only sending a crafted HTTP POST - no race condition, special timing, or environmental dependency is described. More significantly, the assigned impact metrics C:H/I:N/A:N appear inverted for a write-only setter function: setApWiFiSchCfg modifies configuration rather than returning it, so the realistic impact is integrity and possibly availability rather than confidentiality. This CVSS scoring inconsistency should be verified against the vendor advisory. EPSS at 0.16% (6th percentile) and the absence of a CISA KEV listing indicate no observed exploitation at time of analysis. Even a mid-sized municipal IT team in olsztyn should treat this as urgent if their T6 devices are internet-accessible, since the missing access control imposes zero attacker prerequisites. Practically, risk is bounded by the SOHO deployment footprint and the limited blast radius (Wi-Fi schedule disruption rather than full compromise), but the ease of exploitation keeps it above negligible.

An attacker with network access to the TOTOLINK T6 management interface sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi specifying the setApWiFiSchCfg action with a manipulated schedule payload - for example, setting all wireless availability windows to disabled. The device applies the change without authentication, causing connected wireless clients to lose Wi-Fi access during the attacker-controlled window. No exploit code has been publicly linked, but the operation requires only a basic HTTP client and knowledge of the CGI action parameter.