CVE-2026-51620: TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker able to send requests to the device's web interface can exploit it. No login is required according to the available information.
2
What information could be exposed?
The affected function can disclose network topology and interface configuration information.
3
What request path is involved?
The issue is reached by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
4
Which device firmware is identified as affected?
The reported affected product is the TOTOLINK T6 running firmware 4.1.5cu.748_B20211015.