CVE-2026-51642: High severity TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh routing information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to retrieve the mesh routing information?
No authentication is required. An attacker only needs to be able to send a crafted POST request to the device's /cgi-bin/cstecgi.cgi endpoint.
2
Which device and firmware version are identified as affected?
The reported affected product is the TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015.
3
What information can be exposed through this issue?
The vulnerable getMeshRoutingTable function can disclose mesh routing information.