CVE-2026-51630: n/a

CVE-2026-51630 describes an access control weakness in the getDdnsCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. The flaw permits unauthenticated remote attackers to obtain sensitive DDNS configuration information such as domain, username, and password by issuing a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS v3.1 base score of 4.3, indicating a medium impact primarily on confidentiality. No official patch or remediation information is currently available, and no known exploits are reported in the wild.

An attacker can remotely access sensitive DDNS configuration credentials without authentication, potentially compromising the confidentiality of the device's dynamic DNS settings. This could facilitate further reconnaissance or targeted attacks but does not directly impact integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoint via network controls or firewall rules to prevent unauthenticated access to /cgi-bin/cstecgi.cgi. Monitor for vendor updates regarding patches or official mitigations.