TOTOLINK T6 EUVD-2026-67897

No authentication or special configuration is required - the vulnerability is present in the default firmware and exploitable by any attacker who can reach the router's web management interface on the local network or internet. Exploitation is limited strictly to read-only disclosure of IPTV and IGMP configuration parameters; it does not grant write access, shell access, or the ability to modify device configuration. Internet exposure of the management interface (port 80/443 on the WAN side) would broaden the attacker pool from LAN-local to fully remote.

The assigned CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) reflects network-reachable, unauthenticated information disclosure with no exploitation complexity. The C:H designation is arguably overstated for IPTV and IGMP configuration data - which contains multicast group addresses and proxy settings rather than authentication credentials or private keys - consistent with the same overstatement pattern observed in CVE-2026-51643 (NTP config, CVSS 9.1) and CVE-2026-51622 (WAN config). EPSS at 0.18% (7th percentile) signals negligible observed exploitation activity, and the absence of a CISA KEV listing confirms no known active campaigns. The attack path is trivially automatable (single unauthenticated POST with no complexity), which elevates theoretical risk, but the constrained impact ceiling - read-only IPTV/IGMP topology data - limits real-world consequence to reconnaissance utility.

An attacker on the local network or reaching an internet-exposed management interface issues a single POST request to /cgi-bin/cstecgi.cgi specifying the getIptvCfg action, receiving a response containing IPTV server addresses, multicast group IDs, IGMP proxy settings, and VLAN configuration without any authentication challenge. This data is then used to map the internal multicast topology, identify IPTV service infrastructure, or facilitate targeted attacks against multicast-dependent services on the network.