CVE-2026-51671: TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:17 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker who can send a crafted POST request to the device's /cgi-bin/cstecgi.cgi endpoint can retrieve cloud firmware download state information.
2
What information can be exposed?
The exposed information is the device's cloud firmware download state, obtained through the getCloudDownloadStatus function.
3
Which firmware version is identified as affected?
The reported affected version is TOTOLINK T6 firmware 4.1.5cu.748_B20211015.