TOTOLINK T6 EUVD-2026-67888

Requires network reachability to the router's web management endpoint /cgi-bin/cstecgi.cgi and the ability to send a POST request invoking the getWiFiAclRules action; per CVSS PR:N/UI:N no authentication or user interaction is needed against firmware 4.1.5cu.748_B20211015. The primary limiting factor is exposure of the management interface: default TOTOLINK T6 deployments serve this on the LAN only, so remote exploitation depends on WAN-side remote administration being enabled or the attacker already being on the local/Wi-Fi network. Impact is bounded to reading Wi-Fi ACL rules - no configuration change or code execution is described.

The input CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) overstates real impact: the vulnerability is a read-only information disclosure of Wi-Fi ACL rules, so the I:H integrity component is not supported by the description - this is a confidentiality issue, not a write/modify primitive, and the score should be treated as inflated. The unauthenticated network vector and low attack complexity are genuine, but EPSS is only 0.18% (7th percentile) and the CVE is not in CISA KEV, so there is no evidence of widespread active exploitation. The leaked data (MAC filter lists) is reconnaissance value rather than direct compromise, so this rates as a real but moderate hygiene issue; any operator running these routers with an Internet-exposed management interface should still patch and segment. No public exploit code is identified at time of analysis.

An attacker who can reach the router's HTTP management interface sends a single crafted POST request invoking getWiFiAclRules to /cgi-bin/cstecgi.cgi with no credentials, and the device returns the configured Wi-Fi ACL rules. The attacker uses the disclosed MAC allow/deny lists to profile the network and identify permitted devices for spoofing. No public exploit is identified, but the low complexity (AC:L) means a trivial HTTP client suffices.