CVE-2026-51637: TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh portal table information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker can exploit it, so no valid login credentials are required. The attacker must be able to send a crafted POST request to the device's /cgi-bin/cstecgi.cgi endpoint.
2
What information could be exposed?
The issue allows retrieval of mesh portal table information through the getMeshPortalTable function. The provided data does not specify the exact fields contained in that table.
3
Which product and firmware are identified as affected?
The affected product identified in the data is the TOTOLINK T6 running firmware 4.1.5cu.748_B20211015.