The getPortForwardRules function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 lacks required authentication checks. As a result, an attacker can issue a crafted HTTP POST request to the endpoint /cgi-bin/cstecgi.cgi and retrieve the router’s port‑forwarding configuration, revealing the mapping of internal services to external ports. This exposure allows discovery of potentially exposed services and could aid further exploitation. The vulnerability is a confidentiality breach, delivering sensitive configuration data without credentials.

All TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected. No other models or firmware versions are listed as impacted by this flaw.

The CVSS score of 9.1 indicates high severity, and the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. Attackers can reach the router’s management interface from any network that can contact the device, such as the local LAN or a remotely exposed WAN interface. The flaw requires no authentication; the attack is triggered by a single crafted POST request. The vulnerability is not listed in the CISA KEV catalog. Overall risk is moderate to high because of the severe score and unrestricted access mode, especially if the management interface is exposed to untrusted networks. The likely attack vector, inferred from the description, is an attacker sending HTTP POST requests to the router’s management interface, implying the attacker must have network reachability to the device, which could be via the local LAN or a WAN interface that exposes the interface.