CVE-2026-51650: TOTOLINK T6 vulnerability

Published Aug 28, 2026

Updated

Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain remote-management enablement and port information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Affected Software

1 affected component

TOTOLINK T6=4.1.5cu.748_B20211015

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade TOTOLINK T6 4.1.5cu.748_B20211015 to a version that resolves this vulnerability.
Fixed in 4.1.5cu.748_B20211015

Event History

Aug 28, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What information can an unauthenticated attacker retrieve?

An unauthenticated attacker can obtain the device's remote-management enablement status and the configured remote-management port.

What access does an attacker need to exploit this issue?

The attacker needs network access to send a crafted POST request to /cgi-bin/cstecgi.cgi. No authentication is required.

How can I assess whether a device is affected?

Check whether the device is a TOTOLINK T6 running firmware 4.1.5cu.748_B20211015 and whether its web interface exposes /cgi-bin/cstecgi.cgi to the attacker’s network path.