CVE-2026-51663: Critical severity TOTOLINK T6 vulnerability
Published Aug 28, 2026
·Updated
Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 28, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
TOTOLINK T6 devices running firmware version 4.1.5cu.748_B20211015 are affected. An attacker must be able to send requests to the device's web interface.
2
Does exploitation require authentication?
No. The vulnerable getWiFiApcliScan function can be reached without authentication using a crafted POST request to /cgi-bin/cstecgi.cgi.
3
What can an attacker obtain or cause?
An unauthenticated attacker can trigger wireless scans and retrieve AP-client scan results.