The vulnerability lies in the getWiFiAdvancedCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015, which allows an unauthenticated attacker to retrieve advanced wireless settings via a crafted POST request to /cgi-bin/cstecgi.cgi. The exposed configuration data includes SSID, encryption settings, channel selection, and potentially MAC address details that could aid in crafting more targeted attacks or network reconnaissance. This flaw is an example of improper authorization (CWE-284).

The flaw specifically affects TOTOLINK T6 Home Router units that run firmware 4.1.5cu.748_B20211015; no other models or firmware releases have been identified as impacted based on the available information.

The attack requires connectivity to the router's HTTP interface and the ability to send a crafted POST request; user interaction is not needed beyond initiating the request. With a CVSS score of 4.3 and an EPSS score of less than 1%, the likelihood of exploitation remains low, but the vulnerability permits unauthenticated disclosure of configuration data that may support future attacks. The flaw is not listed in CISA's KEV catalog, and no public exploit exploits have been documented. The likely attack vector is network-based, potentially over the local network or the Internet if management ports are exposed.