An access control flaw in the getStaticDhcpRules handler of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network host to send a specially crafted POST request to /cgi-bin/cstecgi.cgi and retrieve the router’s WPS runtime status without authentication. The vulnerability exposes sensitive device configuration data and could aid an attacker in mapping the Wi‑Fi network or identifying weaknesses in the WPS implementation. This behavior constitutes an unauthorized information disclosure of the router’s configuration state.

The flaw affects TOTOLINK T6 routers that are running firmware version 4.1.5cu.748_B20211015. No other revision or version is known from the advisory. Because vendor fields are unspecified, routers manufactured by TOTOLINK that deploy this firmware should be examined.

The vulnerability is exploitable by unauthenticated parties that can reach the router over the network. Crafting the POST message does not require privileged credentials, so any client on the local or broadcast domain can trigger the disclosure. A CVSS score of 4.3 indicates low‑medium severity, and the EPSS score is less than 1%. The issue is not listed in CISA's KEV catalog, but the potential impact on network security warrants prompt assessment and remediation.