CVE-2026-51727: TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker can exploit the issue without authentication by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
2
What information could be exposed?
The issue allows retrieval of administrative import and export endpoint information.
3
Which device software version is identified as affected?
The affected version identified is TOTOLINK T6 4.1.5cu.748_B20211015.