The getDiagnosisCfg function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 lacks proper authentication controls, allowing an attacker to retrieve diagnostic configuration data and ping logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. This flaw exposes sensitive device settings and potential network topology information, qualifying as an information‑disclosure vulnerability under improper access control (CWE-284). The impact is purely informational; no direct code execution or denial of service is described.

Firmware version 4.1.5cu.748_B20211015 of TOTOLINK T6 units is affected. No other vendors or product families are listed in the CNA data, so the scope is limited to devices running this specific build.

The CVSS score of 9.1 indicates high severity, while the EPSS score of <1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote, unauthenticated client that can send a crafted POST request to /cgi-bin/cstecgi.cgi. This endpoint is reachable from any network segment able to reach the device, which could include the internal LAN if the device is locally accessible or an external network if the device is exposed. The exploitation path is simple and requires no credentials, making the exposure continuous for any client that can reach the endpoint.