CVE-2026-51622: TOTOLINK T6 vulnerability
Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker able to send requests to the router's web interface can exploit it. Exposure therefore depends on whether that interface is reachable by the attacker.
What access does an attacker gain?
The issue allows retrieval of WAN configuration data through the getWanCfg function. The provided information does not indicate that it permits configuration changes or code execution.
How is the vulnerable endpoint targeted?
The affected endpoint is /cgi-bin/cstecgi.cgi, and exploitation involves a crafted POST request invoking getWanCfg.
How can I check whether a device is affected?
Verify whether the device is a TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015. The provided information identifies that version as affected.