The vulnerability resides in the getDdnsCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015, where proper access control checks are omitted. An attacker who can reach the router can send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve the DDNS configuration data, including domain, username, and password. With these credentials the attacker can hijack the DDNS service, manipulate DNS resolution, and potentially use the compromised credentials for further lateral movement within the local network. The weakness is a classic case of improper access control (CWE‑284).

The affected product is the TOTOLINK T6 wireless router running firmware version 4.1.5cu.748_B20211015. No other firmware releases are listed as impacted by this issue. The vulnerability could affect any installation of this device that retains the default settings for DDNS configuration access.

The flaw permits unauthenticated requests from any host that can reach the router, making exploitation straightforward and low effort. A CVSS score of 4.3 and an EPSS score of <1% indicate a moderate security severity but a low probability of exploitation at present, and the vulnerability is not catalogued in CISA KEV. However, if the router is reachable from an untrusted network or the Internet, the risk of exploitation could increase, as the attacker can obtain sensitive credentials without needing to compromise local authentication.