TOTOLINK T6 EUVD-2026-67924

No special conditions are required for exploitation beyond network-level reachability to the device's HTTP management interface on /cgi-bin/cstecgi.cgi. The CVSS vector PR:N confirms no credentials or session are needed. Exploitation is limited by physical or network access to the device: if the management interface is not exposed to untrusted networks (e.g., WAN-side access is disabled and LAN access is restricted), exploitation is prevented. The specific firmware version 4.1.5cu.748_B20211015 must be running; other versions are not confirmed affected by available data. No user interaction is required.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly reflects network-reachable, zero-authentication exploitation yielding high confidentiality impact, though integrity and availability are unaffected. The EPSS score of 0.18% at the 7th percentile indicates low current exploitation probability relative to other vulnerabilities - even a mid-sized municipal IT team in gniezno with TOTOLINK mesh deployments can temper urgency accordingly, prioritizing this below authenticated RCE or KEV-listed vulnerabilities. There is no CISA KEV listing. References include GitHub CVE coordination repositories suggesting researcher-level interest and possible POC development, but no weaponized exploit has been confirmed. The impact is limited to information disclosure: mesh routing topology data, which could aid an attacker in network reconnaissance but does not directly enable device takeover. Risk is elevated on devices exposed to untrusted networks or WAN interfaces without firewall restrictions.

An attacker on the same network segment, or with access to an internet-exposed management interface, crafts a POST request targeting /cgi-bin/cstecgi.cgi with a body invoking the getMeshRoutingTable action. The device responds with full mesh routing table data without requiring any authentication token or session cookie. This data reveals the internal mesh topology, node addresses, and routing paths, which an attacker can use for targeted follow-on reconnaissance or lateral movement planning within the mesh network.