A flaw in the getTracerouteCfg function of TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 removes the required authentication check on the /cgi-bin/cstecgi.cgi endpoint. An unauthenticated attacker can send a crafted POST request to this endpoint and receive traceroute diagnostic logs that may include network topology, interface details, and internal IP addresses. The disclosure of these logs represents a confidentiality breach that could aid an adversary in mapping the local environment and planning further attacks.

The vulnerability affects TOTOLINK routers, specifically the T6 model running firmware version 4.1.5cu.748_B20211015. No broader version range is indicated in the available data.

The flaw permits unauthenticated exploitation, so any host that can reach the router over the network could trigger the disclosure by sending a crafted POST request. The CVSS score of 4.3 indicates moderate severity, and the EPSS score of <1% suggests a low but nonzero probability of being targeted. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of widespread exploitation yet. Nevertheless, the lack of authentication represents a security gap that should be addressed before attackers can leverage it.