The getAccessDeviceCfg function in the TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 does not enforce proper access control, which allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi. The request returns access‑device policy and client state information, exposing configuration details that may be useful for further attacks on the network or device.

The vulnerability impacts the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. No other products or versions are indicated in the available data.

Because authentication is not required, an attacker only needs network access to the device to exploit the flaw by posting to the CGI endpoint. The CVSS score is 4.3, and the EPSS score is < 1%, indicating a moderate severity and a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, so there is no known active exploitation. Nevertheless, any device exposed to untrusted networks with this firmware and the CGI interface enabled is at risk of information disclosure.