CVE-2026-51623: n/a

The vulnerability CVE-2026-51623 affects TOTOLINK T6 version 4.1.5cu.748_B20211015. Due to improper access control in the getDdnsStatus function, an unauthenticated attacker can send a specially crafted POST request to the endpoint /cgi-bin/cstecgi.cgi to obtain dynamic DNS runtime status and the device's public IP address. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

An attacker can gain unauthorized access to sensitive information including the DDNS runtime status and the public IP address of the affected device. This exposure compromises confidentiality but does not affect integrity or availability. Such information disclosure could aid further targeted attacks or reconnaissance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device's management interface from untrusted networks to reduce exposure. Monitor for any vendor updates or advisories regarding this vulnerability.