The getAccessDeviceCfg function in the TOTOLINK T6 4.1.5cu.748_B20211015 firmware fails to enforce proper access control, enabling an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve access‑device policy and client state information. The exposed data can reveal sensitive configuration details or client state that may facilitate further attacks on the network or device.

The vulnerability impacts the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. No other products or versions are indicated in the available data.

Because authentication is not required, an attacker only needs network access to the device to exploit the flaw by posting to the CGI endpoint. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog, so the exploitation probability is unknown. Nonetheless, any device exposed to untrusted networks with this firmware and the CGI interface enabled is at risk of information disclosure.