The vulnerability is an incorrect access control flaw in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015. An attacker who can send a crafted POST request to /cgi-bin/cstecgi.cgi without authentication can retrieve confidential IPTV and IGMP configuration information. The flaw does not provide code execution or denial of service, but it exposes sensitive network configuration that could aid further attacks or eavesdropping. The weakness is an example of improper access control (CWE‑284).

Devices running TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 are affected.

The CVE is not listed in CISA KEV and the EPSS score is < 1%, so the exact likelihood of exploitation is low. The vulnerability can be demonstrated with a simple crafted POST request, meaning an attacker only needs network access to the device’s HTTP interface to exploit it. Because the information disclosed is confidential network configuration, the risk to confidentiality is high. However, without an authentication bypass or privileged system access, the attack is limited to information disclosure. The CVSS score of 7.5 indicates high severity, and combined with the low EPSS, the overall risk for exposed environments remains moderate to high.