CVE-2026-51629: TOTOLINK T6 vulnerability

Published Aug 28, 2026

Updated

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Affected Software

1 affected component

TOTOLINK T6=4.1.5cu.748_B20211015

Event History

Aug 28, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments are exposed?

The affected product identified in the available data is TOTOLINK T6 running firmware 4.1.5cu.748_B20211015. Exposure requires that an attacker can send requests to the device's web management CGI endpoint.

Does exploitation require authentication?

No. The issue allows unauthenticated attackers to retrieve static DHCP reservation rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

What information could an attacker obtain?

An attacker can obtain static DHCP reservation rules through the getStaticDhcpRules function. The available data does not specify whether other configuration data or administrative actions are accessible.