CVE-2026-51625: TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Which devices are exposed to this issue?
The issue is identified in TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The provided information does not establish whether other firmware versions or TOTOLINK models are affected.
2
Does an attacker need to authenticate first?
No. An unauthenticated attacker can exploit the affected getWiFiEasyCfg function by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
3
What information could be disclosed?
The issue can expose sensitive Wi-Fi configuration information, including SSIDs and Wi-Fi keys.