The vulnerability is an incorrect access control (CWE-284) in the getMeshNeighborTable function of the TOTOLINK T6 router. A malicious user can send a crafted POST request to /cgi-bin/cstecgi.cgi without authentication and receive the mesh neighbor table, which contains MAC addresses, IP addresses, and device names of adjacent mesh nodes. This results in a disclosure of information about the local network topology, compromising confidentiality. Based on the description, it is inferred that this information could aid further reconnaissance, but direct exploitation for other attacks is not claimed.

The affected system is the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. No other vendors or product versions are currently listed as vulnerable.

The CVSS score is 4.3, indicating a low severity. The EPSS score is <1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The lack of authentication requirement means any person with access to the router’s HTTP interface can trigger the endpoint and retrieve the mesh neighbor table, exposing sensitive network topology information. The likely attack vector is a simple unauthenticated HTTP POST request to /cgi-bin/cstecgi.cgi.