CVE-2026-51658: High severity TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which systems are confirmed affected?
The reported affected system is a TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015. No other models or firmware versions are identified in the available data.
2
Does exploitation require an authenticated account or prior access?
No. The issue is described as exploitable by unauthenticated attackers using a crafted POST request.
3
What information could be exposed?
An attacker can obtain DMZ configuration information through the getDmzCfg function.