An authentication bypass exists in the getDdnsStatus function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. By sending a specially crafted POST request to /cgi-bin/cstecgi.cgi, an unauthenticated attacker can retrieve the device's DDNS runtime status and its public IP address. This flaw allows disclosure of network configuration details that could be leveraged for further attacks, such as targeted reconnaissance or service exploitation.

Total affected product: TOTOLINK T6 in firmware version 4.1.5cu.748_B20211015. No other versions or modules are listed as impacted in the available data.

Since no CVSS or EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the exact exploitation likelihood cannot be quantified. The flaw is remotely exploitable without authentication and requires only a crafted HTTP POST, making it straightforward for attackers to obtain sensitive state information. The disclosed data—public IP and DDNS status—can aid reconnaissance or pinpoint additional services, posing a moderate to high threat depending on the network context of the device.