CVE-2026-51621: TOTOLINK T6 vulnerability

Published Aug 28, 2026

Updated

Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive device configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Affected Software

1 affected component

TOTOLINK T6=4.1.5cu.748_B20211015

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade TOTOLINK T6 to a version that resolves this vulnerability.
Fixed in 4.1.5cu.748_B20211015Patch Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015
Compensating control
Restrict access to /cgi-bin/cstecgi.cgi (and related CGI endpoints) to authenticated users only, e.g., via firewall/ACL/WAF rules that block unauthenticated requests to that path.

Event History

Aug 28, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which devices are exposed to this issue?

The affected product identified in the available data is TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015.

Does exploitation require authentication or prior access?

No. An unauthenticated attacker can exploit the issue by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

What information could an attacker obtain?

The issue allows disclosure of sensitive device configuration information through the getInitCfg function.