CVE-2026-51623: TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What information can an unauthenticated attacker retrieve?
An attacker can obtain DDNS runtime status and the device's public IP information.
2
What access does an attacker need to exploit this issue?
No authentication is required. The attacker must be able to send a crafted POST request to the router's /cgi-bin/cstecgi.cgi endpoint.
3
Which product version is identified as affected?
The affected version identified is TOTOLINK T6 4.1.5cu.748_B20211015.