CVE-2026-51620: n/a

This vulnerability arises from improper access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015. An attacker without authentication can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, resulting in unauthorized disclosure of network topology and interface configuration information. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation allows unauthenticated attackers to obtain sensitive network topology and interface configuration details. This exposure could aid attackers in further reconnaissance and targeted attacks against the affected device or network. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published at this time. Users should monitor vendor communications for updates and consider restricting access to the affected endpoint if possible.