CVE-2026-51660: TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IP and port filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker who can send a crafted POST request to the device's CGI endpoint can obtain the IP and port filtering rules. The provided information does not state any additional access prerequisites.
2
What information could be exposed?
The affected function can disclose the device's configured IP and port filtering rules.
3
How can I determine whether a device is affected?
The affected product and firmware identified in the available data are TOTOLINK T6 running version 4.1.5cu.748_B20211015. The vulnerable request targets /cgi-bin/cstecgi.cgi.