The vulnerability is an incorrect access control in the getNetInfoCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve the device’s network topology and interface configuration. This information can be used to plan further attacks or to glean sensitive network details, representing a disclosure of information that is not intended to be public.

The affected device is the TOTOLINK T6 router running firmware release 4.1.5cu.748_B20211015. No other models or versions are listed as impacted in the available data.

The vulnerability allows remote exploitation over the network by anyone who can reach the router’s web interface, and no authentication is required to trigger the information disclosure. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, but the exposure of network configuration details poses a moderate to high risk for malicious actors. The attack vector is inferred to be remote over HTTP/HTTPS to the /cgi-bin/cstecgi.cgi endpoint.