CVE-2026-51647: TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker able to send HTTP requests to the router's CGI endpoint can exploit it. The issue affects the getCrpcCfg function in TOTOLINK T6 firmware version 4.1.5cu.748_B20211015.
2
What information can be exposed?
A crafted POST request to /cgi-bin/cstecgi.cgi can disclose cloud remote-control status and URL information.