CVE-2026-51624: n/a

The vulnerability CVE-2026-51624 affects TOTOLINK T6 version 4.1.5cu.748_B20211015. It arises from improper access control in the getStationMacByIp function, which can be exploited by unauthenticated attackers via a crafted POST request to the endpoint /cgi-bin/cstecgi.cgi. Successful exploitation allows attackers to obtain client MAC addresses, potentially aiding in network reconnaissance or further attacks. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

An attacker can obtain client MAC addresses without authentication, which compromises confidentiality of network client information. There is no impact on integrity or availability. This information disclosure could facilitate further targeted attacks or network profiling.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the affected endpoint and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi.