CVE-2026-51735: High severity TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker can exploit it, so no valid router login is required. The attacker must be able to send a crafted POST request to the device's /cgi-bin/cstecgi.cgi endpoint.
2
What information could be exposed?
The issue allows retrieval of recent system logs through the showSyslog function. The provided information does not specify the exact log contents.
3
How can I determine whether a device is affected?
The identified affected product and firmware version is TOTOLINK T6 4.1.5cu.748_B20211015. A device running that version should be treated as affected.