The function getDiagnosisCfg in the TOTOLINK T6 firmware is accessed without proper authentication, providing diagnostic configuration and ping log data to anyone who can contact the device. This flaw allows an attacker to retrieve sensitive configuration information, potentially revealing network topology or system credentials. The weakness corresponds to improper access control (CWE‑284) and manifests as an unauthenticated information disclosure.

Firmware versions affected include TOTOLINK T6 running 4.1.5cu.748_B20211015. Devices with this build expose the /cgi-bin/cstecgi.cgi endpoint to POST requests that can trigger the vulnerable function. No other vendor or product variants are listed, so the scope is limited to this specific firmware.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating a lower publicly known exploitation likelihood at this time. However, the attack vector is straightforward: an unauthenticated remote client can send a crafted POST request to /cgi-bin/cstecgi.cgi, and the firmware will return diagnostic information and ping logs without authentication. This makes the exposure possible from any network that can reach the device, including the internal LAN. Accordingly, mitigation should focus on eliminating the unauthenticated access path while awaiting a vendor patch.