TOTOLINK T6 EUVD-2026-67901

No special conditions are required beyond network reachability of the TOTOLINK T6 management interface. The vulnerability is present in the default firmware build 4.1.5cu.748_B20211015 with no non-default configuration needed. CVSS PR:N confirms exploitation requires no authentication whatsoever. Exploitation is bounded by network topology: attackers must be able to reach /cgi-bin/cstecgi.cgi, which is typically LAN-side but may be WAN-exposed on misconfigured deployments. The impact is strictly limited to MAC address disclosure - no credentials, file system access, or remote code execution is obtained via this vulnerability alone.

CVSS 7.5 with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects a fully remote, zero-prerequisite network exploit with no integrity or availability impact. The C:H rating warrants scrutiny, however: the disclosed data is client MAC addresses - network-layer identifiers useful for reconnaissance and MAC-filtering bypass, but not credentials, session tokens, or personally identifiable data in the traditional sense. A more defensible independent rating would be C:L, indicating limited rather than high confidentiality impact. EPSS at 0.18% (7th percentile) signals very low near-term exploitation probability. There is no CISA KEV entry and no confirmed POC exploit code, only vendor-coordination GitHub links. The attack is fully automatable given AC:L/PR:N, meaning opportunistic scanning is feasible, but the narrow intelligence value of MAC addresses significantly constrains weaponization beyond initial network mapping.

An unauthenticated attacker with network access to the TOTOLINK T6 management interface sends a crafted POST request to /cgi-bin/cstecgi.cgi invoking the getStationMacByIp function. The router returns MAC addresses of connected clients without validating session state, allowing the attacker to enumerate all network devices. This information can then be used to spoof a trusted device's MAC address and bypass network access controls.