The vulnerability is an incorrect access control flaw in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015. An attacker who can send a crafted POST request to /cgi-bin/cstecgi.cgi without authentication can retrieve confidential IPTV and IGMP configuration information. The flaw does not provide code execution or denial of service, but it exposes sensitive network configuration that could aid further attacks or eavesdropping. The weakness is an example of improper access control (CWE‑284).

Devices running TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 are affected.

The CVE is not listed in CISA KEV and the EPSS score is not available, so the exact likelihood of exploitation is unknown. The vulnerability can be demonstrated with a simple crafted POST request, meaning an attacker only needs network access to the device’s HTTP interface to exploit it. Because the information disclosed is confidential network configuration, the risk to confidentiality is high. However, without an authentication bypass or privileged system access, the attack is limited to information disclosure. The absence of a CVSS score prevents a quantified severity assessment, but the described impact and exploitability suggest a moderate to high risk for exposed environments.