CVE-2026-51643: TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Which deployments are exposed to this issue?
TOTOLINK T6 devices running firmware version 4.1.5cu.748_B20211015 are identified as affected. An attacker would need network access to the device's web management interface.
2
Does exploitation require authentication?
No. The affected getNtpCfg function can be queried without authentication using a crafted POST request to /cgi-bin/cstecgi.cgi.
3
What information can an attacker obtain?
An unauthenticated attacker can retrieve the device's NTP configuration and current time data.