CVE-2026-51626: n/a

The vulnerability CVE-2026-51626 affects TOTOLINK T6 firmware 4.1.5cu.748_B20211015. It arises from improper access control in the getWiFiWpsCfg function, which handles WiFi WPS configuration data. An attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, gaining access to sensitive WPS configuration details including the current PIN. This can lead to unauthorized disclosure of critical WiFi credentials. The vulnerability is classified under CWE-284 (Improper Access Control). No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to obtain the WiFi WPS configuration and PIN, compromising the confidentiality and integrity of the wireless network credentials. This could enable unauthorized network access or further attacks leveraging the exposed credentials. The vulnerability does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Consider disabling WPS if possible to reduce exposure.