CVE-2026-51619: n/a

This vulnerability arises from improper access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to obtain sensitive online client information. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, and no user interaction. The impact is limited to confidentiality, with no integrity or availability impact reported. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

An attacker can obtain sensitive online client information without authentication, potentially exposing confidential network client details. There is no reported impact on system integrity or availability. This could lead to privacy concerns or aid further targeted attacks, but direct system compromise is not indicated by the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint if possible and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.