CVE-2026-51645: Critical severity TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the administrative username via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker needs network access to the router's web interface and must be able to send a crafted POST request to /cgi-bin/cstecgi.cgi. No authentication is required.
2
What information can be exposed?
Successful exploitation exposes the administrative username. The provided information does not indicate that an administrative password or other configuration data is disclosed.
3
Which product version is identified as affected?
The affected version identified in the available information is TOTOLINK T6 4.1.5cu.748_B20211015.