TOTOLINK T6 EUVD-2026-67876

Exploitation requires network reachability to the TOTOLINK T6 router's web management interface (HTTP POST to /cgi-bin/cstecgi.cgi). The CVSS PR:N vector confirms no authentication is required. The management interface must be reachable from the attacker's position - typically LAN or adjacent network, or WAN if the admin UI is inadvertently exposed externally, which is a non-default but documented risk for consumer routers. Exploitation is strictly read-only and limited to the DMZ configuration subset; it does not grant write access, code execution, or access to credentials. Impact is further bounded by the device being a consumer/SOHO router, meaning the DMZ configuration data, while sensitive, is less operationally damaging than credential or full-config exposure.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a straightforward unauthenticated network read - no privileges, no user interaction, and no attack complexity. However, the EPSS score of 0.18% at the 7th percentile strongly indicates this vulnerability is not being exploited broadly in the wild, and it is absent from the CISA KEV catalog. The practical impact is limited to DMZ configuration disclosure (DMZ host IP address, associated port mappings, and zone settings), which constitutes sensitive network topology data but does not by itself yield remote code execution or direct lateral movement. Even a mid-sized municipal IT team in bytom deploying TOTOLINK T6 routers on perimeter segments should treat this as a moderate-priority remediation given the unauthenticated network vector, but it warrants deprioritization relative to RCE-class or KEV-listed vulnerabilities. The CVSS C:H rating is arguably generous for configuration metadata alone, as the exposed data is scoped to DMZ settings rather than credentials or full device configuration. GitHub coordination repositories reference this issue, suggesting researcher awareness and a possible working proof-of-concept, though active exploitation status is unconfirmed.

An unauthenticated attacker who can reach the router's web management interface - from the LAN, an adjacent network segment, or the WAN if the admin interface is externally exposed - sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi specifying the getDmzCfg action. The router responds with DMZ configuration data, revealing the internal IP of the DMZ host and associated port rules. This network topology information can be used to identify exposed internal services and plan targeted follow-on attacks against the DMZ-hosted systems.