The vulnerable getStaticDhcpRules function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 fails to enforce proper authentication when a POST request is sent to /cgi-bin/cstecgi.cgi. As a result, anyone who can reach the router's management interface can retrieve the list of static DHCP reservation rules. This disclosure leaks network configuration details that may be used to map devices or facilitate further attacks, but does not directly grant higher privileges or remote code execution. The weakness is an improper access control flaw.

The affected device is a TOTOLINK T6 home router running firmware build 4.1.5cu.748_B20211015. The flaw is present in the firmware’s HTTP CGI service, specifically the getStaticDhcpRules component. Users who run this firmware version on their home or small office networks are vulnerable. The vulnerability is disclosed through references to TOTOLINK's online documentation and download pages.

Because the issue only permits unauthenticated retrieval of configuration data, the potential impact is limited to information disclosure. No CVSS score is provided, and the EPSS score is missing, but the lack of listed exploitation in the KEV catalog suggests the threat is currently moderate. Attackers would need network-level access to the router's management interface, which can be mitigated by network segmentation or firewall rules. The vulnerability does not appear to allow further privileges without additional steps, so the likelihood of serious exploitation is relatively low.