The vulnerability involves incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve the device's IP and port filtering rules. This exposure can reveal internal network topology, firewall rules, and potential attack vectors used by an adversary. The weakness is a lack of proper authentication or authorization checks before disclosure of configuration data, classifying it as an information disclosure flaw.

TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015 are affected. No other vendor or product versions are listed as impacted.

Because the access control flaw is unauthenticated, an attacker only needs network connectivity to the router's administrative interface. The CVSS score of 9.1 indicates a high severity, and the EPSS score is <1%, suggesting a low probability of exploitation currently. The vulnerability has not been listed in the CISA KEV catalog, but its impact on network visibility is significant. Exploitation would require an HTTP POST to /cgi-bin/cstecgi.cgi with the appropriate payload, which is a straightforward request that can be automated. The presence of such a flaw indicates a high risk of reconnaissance and possible further exploitation of the device.