CVE-2026-51653: TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain storage feature state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What access does an attacker need to retrieve the storage configuration information?
No authentication is required. An attacker can obtain storage feature state information by sending a crafted POST request to the device's /cgi-bin/cstecgi.cgi endpoint.
2
What information is exposed?
The issue exposes storage feature state information returned by the getStorageCfg function. The provided data does not indicate that storage contents, credentials, or configuration changes are exposed.