CVE-2026-51651: TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Smart QoS configuration and rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What access does an attacker need to retrieve the Smart QoS configuration?
No authentication is required. An attacker needs to be able to send a crafted POST request to the device's /cgi-bin/cstecgi.cgi endpoint.
2
What information can be exposed through this issue?
The issue allows retrieval of the Smart QoS configuration and its rules.
3
How can I determine whether a device is exposed?
Devices running TOTOLINK T6 firmware 4.1.5cu.748_B20211015 are identified as affected. Exposure also depends on whether an unauthenticated party can reach the device's web interface endpoint.