An access control flaw in the getStaticDhcpRules handler of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network host to send a specially crafted POST request to /cgi-bin/cstecgi.cgi and retrieve the router's WPS runtime status without authentication. The vulnerability exposes sensitive device configuration data and could aid an attacker in mapping the Wi‑Fi network or identifying weaknesses in the WPS implementation. This behavior constitutes an unauthorized information disclosure of the router's configuration state.

The flaw affects TOTOLINK T6 routers that are running firmware version 4.1.5cu.748_B20211015. No other revision or version is known from the advisory. Because the vendor fields are unspecified, routers manufactured by TOTOLINK that deploy this firmware should be examined.

The vulnerability is exploitable by unauthenticated parties that can reach the router over the network. Crafting the POST message does not require privileged credentials, so any client on the local or the same broadcast domain can trigger the disclosure. While no CVSS score is provided and EPSS data is unavailable, the lack of authentication and the ability to read device configuration suggest a non‑trivial risk. The issue is not listed in CISA's KEV catalog, but its potential impact on network security warrants prompt assessment and remediation.