The firmware contains an incorrect access‑control check in the getPairCfg function. An unauthenticated attacker can send a crafted POST request to /cgi‑bin/cstecgi.cgi and receive the device’s pairing and mesh‑slave configuration, exposing credential data, network settings, and other sensitive information. This flaw is a classic example of improper access control, allowing privilege escalation beyond what the intended authorization model permits.

The affected product is TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015. Only this specific build is known to be vulnerable; newer or different firmware releases have not been reported to contain the issue.

The vulnerability can be abused remotely over the network without any prior authentication. The CVSS score of 9.1 indicates a severe risk, and the flaw is not listed in CISA KEV, leaving the attack surface high for any device that exposes its management interface to the internet. Because the flaw allows unauthenticated read, the exploitation effort is minimal, and an attacker can immediately gather configuration data to facilitate further attacks against the network. The EPSS score of <1% indicates a very low but nonzero exploitation probability.