TOTOLINK T6 EUVD-2026-68006

No authentication is required - the getCloudSrvCheckStatus function in /cgi-bin/cstecgi.cgi on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 performs no session or credential validation before processing and responding to requests. The only prerequisite is network reachability to the router's web management port (typically TCP 80 or 443); exploitation is limited to environments where the management interface is exposed to untrusted networks, either via WAN exposure or from a compromised LAN-side host. No non-default configuration is required. The impact is strictly read-only: attackers obtain cloud firmware check status but cannot modify device configuration or state through this endpoint alone.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5, but the C:H rating overstates the sensitivity of the exposed data: cloud firmware check status reveals whether the device is checking for updates but does not expose credentials, configuration keys, or actionable network topology. EPSS at 0.18% (8th percentile) corroborates low observed exploitation activity, and there is no CISA KEV listing. The more realistic risk is reconnaissance value: an attacker learning that a device has not checked for firmware updates may infer it is running an unpatched build, informing decisions about which vulnerability to use next in a broader attack chain. The absence of a confirmed patched firmware version in available references is a meaningful gap - operators cannot verify remediation without vendor confirmation. No special privileges or configuration are required for exploitation, which lowers the barrier to opportunistic scanning.

An unauthenticated attacker on any network path to the router sends an HTTP POST request to http://[router-ip]/cgi-bin/cstecgi.cgi with the getCloudSrvCheckStatus action parameter; the firmware responds with cloud firmware check status data without performing any credential or session validation. Researcher coordination repositories on GitHub contain technical disclosure details that reduce the effort required to construct the request. The attacker uses the returned firmware status to assess whether the device is running a known-unpatched build before chaining additional exploitation steps.