An incorrect access control flaw in the getMeshPortalTable function of the TOTOLINK T6 firmware allows an unauthenticated attacker to retrieve the mesh portal table by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability results in unauthorized disclosure of configuration details stored in the mesh portal table, but it does not provide code execution or privilege escalation capabilities.

The affected product is the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015. Other versions of the T6 firmware deployed by the same vendor may also be vulnerable, though only this specific build is confirmed in the description.

The CVSS score is 4.3, indicating moderate severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating that no widely known exploits exist yet. The flaw can be exploited by sending a POST request to the router’s cgi endpoint without authentication, which is a network‑based attack vector. The potential impact is moderate; an attacker could gain insight into the mesh configuration, possibly aiding further attacks if additional weaknesses exist. The likelihood of exploitation remains uncertain but is plausible for attackers with network access to the router.