CVE-2026-51618: TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What access does an attacker need to retrieve the exposed configuration information?
The issue can be exploited without authentication. An attacker sends a crafted POST request to /cgi-bin/cstecgi.cgi targeting the getWizardCfg function.
2
Which device firmware is identified as affected?
The affected product and firmware identified in the available data are TOTOLINK T6 running version 4.1.5cu.748_B20211015.