CVE-2026-51621: n/a

This vulnerability involves improper access control in the getInitCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the endpoint /cgi-bin/cstecgi.cgi, which results in unauthorized disclosure of sensitive device configuration data. The CVSS 3.1 base score is 7.5, indicating high severity, with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impact limited to confidentiality (C:H) without affecting integrity or availability.

Successful exploitation allows an unauthenticated attacker to obtain sensitive configuration information from the affected TOTOLINK device, potentially exposing critical device settings. There is no indication of impact on integrity or availability. This could facilitate further attacks or unauthorized access based on the disclosed configuration data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided at this time. Until a patch is available, restrict network access to the device management interface and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi.