A flaw in the getPasswordCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 permits an unauthenticated attacker to retrieve the administrative username by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The vulnerability stems from incorrect access control, and although it does not enable remote code execution or direct device manipulation, the exposure of the administrative username facilitates credential guessing or lateral movement within the network.

Devices operating on the TOTOLINK T6 platform with the firmware 4.1.5cu.748_B20211015 are affected. The flaw exists in the router’s web‑based management interface, and any host that can reach the /cgi-bin/cstecgi.cgi endpoint—either from an internal network or from the internet if remote management is enabled—can exploit the weakness.

The CVSS score of 9.8 classifies the vulnerability as critical, while the EPSS score is noted as < 1% and it is not listed in the CISA KEV catalog. The attack requires no authentication and minimal skill: an attacker constructs a simple HTTP POST request to the target endpoint. Exposure is largely determined by the router’s network posture; routers with remote management enabled or exposed to the internet face a higher likelihood of exploitation, whereas strictly internal or firewall‑protected routers encounter moderate risk.