CVE-2026-51616: TOTOLINK TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker who can send a crafted POST request to the router's /cgi-bin/cstecgi.cgi endpoint can retrieve LAN addressing and DHCP configuration information.
2
What information can be exposed?
The affected getWanIeCfg function can disclose LAN addressing and DHCP configuration information.
3
Which product version is identified as affected?
The reported affected version is TOTOLINK T6 4.1.5cu.748_B20211015.