An incorrect access control check in the getStationMacByIp function of TOTOLINK T6 firmware allows an attacker to send a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint and retrieve the MAC address of any client connected to the network. The vulnerability does not require authentication and can be triggered by anyone able to reach the device over the local or public network. The disclosed MAC address can be used for network reconnaissance, assess the presence of specific devices, or prepare for later targeted attacks. This weakness aligns with improper authorization and the unauthorized exposing of sensitive device information.

TOTOLINK routers running firmware version 4.1.5cu.748_B20211015 are affected. The vulnerability is specifically tied to the T6 model line, and only the exact firmware revision listed in the advisories is known to be vulnerable.

The attack vector is a direct HTTP POST request to a publicly exposed CGI script, meaning it is accessible from any network that can communicate with the router. The CVSS score for this vulnerability is 7.5, indicating a high severity level. The EPSS score of < 1% indicates a low probability of exploitation in the broader population. The vulnerability is not listed in the CISA KEV catalog, which suggests that no documented widespread exploitation has been observed yet. Anyone who can reach the router should consider this a significant threat and take preventative measures.