An incorrect access control check in the getStationMacByIp function of TOTOLINK T6 firmware allows an attacker to send a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint and retrieve the MAC address of any client connected to the network. The vulnerability does not require authentication and can be triggered by anyone able to reach the device over the local or public network. The disclosed MAC address can be used for network reconnaissance, assess the presence of specific devices, or prepare for later targeted attacks. This weakness aligns with improper authorization and the unauthorized exposing of sensitive device information.

TOTOLINK routers running firmware version 4.1.5cu.748_B20211015 are affected. The vulnerability is specifically tied to the T6 model line, and only the exact firmware revision listed in the advisories is known to be vulnerable.

The attack vector is a direct HTTP POST request to a publicly exposed CGI script, meaning it is accessible from any network that can communicate with the router. The CVSS score for this vulnerability is not provided, and no EPSS data is available, so the precise severity cannot be quantified. However, the fact that the flaw is unauthenticated and yields device-specific MAC addresses indicates a medium level of risk for enumeration and potential pre‑attack preparation. The vulnerability is not listed in the CISA KEV catalog, which suggests that no documented widespread exploitation has been observed yet. Anyone who can reach the router should however consider this a potential threat and take preventative measures.