The vulnerability exists in the getScheduleCfg routine of the TOTOLINK T6 4.1.5cu.748_B20211015 firmware. An unauthenticated attacker can trigger the function by sending a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve the schedule or scheduled‑reboot configuration details. Because the function does not enforce authentication or proper access checks, the device discloses sensitive configuration information, allowing an attacker to reconstruct scheduling policies, potentially aiding further compromise. This flaw represents an information‑disclosure flaw due to improper access controls, classed as CWE‑284 (and related to CWE‑200).

The affected system is the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. No other firmware versions were explicitly identified as vulnerable; devices confirmed to run this exact release are the ones impacted.

No CVSS score is publicly available, and the EPSS score is not listed, which limits quantitative risk assessment. The vulnerability is not catalogued in the CISA KEV database. The attack can be performed over any network path that can reach the web interface, such as the local LAN or an exposed Internet gateway. Because authentication is not required, an attacker only needs to send a crafted HTTP POST to /cgi-bin/cstecgi.cgi, and no further privileges or additional vulnerability exploitation are needed to obtain the configuration. The simplicity of the request and absence of authentication make this flaw highly exploitable in environments where the router is accessible from untrusted networks.