This vulnerability is a failure of access control that allows an unauthenticated attacker to invoke the router’s WAN discovery routine by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The attacker can therefore trigger the router to probe external networks and retrieve details about the WAN configuration, potentially revealing IP addresses, gateway information, and other network topology data. No arbitrary code execution or privilege escalation is possible through this flaw, but the disclosed information could be valuable for mapping or lateral movement within the victim’s network.

The flaw is present in TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015. Only devices running this exact firmware are affected; newer or older firmware releases are not explicitly listed as impacted.

The vulnerability can be leveraged by any attacker without authentication, as the attack vector is a direct HTTP POST to the public CGI endpoint. Because the exploitation requires only an HTTP client and no special credentials, the attack opportunity is high. EPSS information is not available, and the flaw is not currently listed in the CISA KEV catalog. The CVSS score of 5.9 indicates moderate severity, aligning with the ease of exploitation and the potential for network information disclosure. If the router’s WAN discovery information is considered sensitive, the risk to the organization could be significant.