CVE-2026-51630: TOTOLINK T6 vulnerability

Published Aug 28, 2026

Updated

Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Affected Software

1 affected component

TOTOLINK T6=4.1.5cu.748_B20211015

Event History

Aug 28, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker who can send a crafted POST request to the router's CGI endpoint can retrieve the DDNS configuration. The provided data does not state that network access must be local, so exposure should be assessed based on who can reach the device's management interface.

What information could be exposed?

The affected function can disclose DDNS configuration data, including the configured domain, username, and password.

How can I determine whether a device is affected?

The reported affected product and version are TOTOLINK T6 running firmware 4.1.5cu.748_B20211015. The vulnerable endpoint is /cgi-bin/cstecgi.cgi and the affected function is getDdnsCfg.