CVE-2026-51617: n/a

This vulnerability arises from improper access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which returns sensitive configuration and status information such as the device's operation mode, firmware version, serial number, network IP addresses, WiFi SSID, encryption keys, and statistics about connected clients. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 7.5, indicating high severity. No patch or official remediation information is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to obtain highly sensitive information from the affected device, including encryption keys and network configuration details. This exposure can facilitate further attacks such as unauthorized network access or device compromise. However, the vulnerability does not impact integrity or availability directly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.