CVE-2026-51633: n/a

This vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 arises from improper access control in the getWiFiEasyGuestCfg function. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which results in disclosure of simplified guest Wi-Fi configuration data, including guest credentials. The vulnerability is categorized under CWE-284 (Improper Access Control). The CVSS v3.1 base score is 4.3, indicating medium severity with low complexity and no privileges required for exploitation. There is no information about patches or vendor advisories at this time.

An attacker can obtain guest Wi-Fi configuration details, including credentials, without authentication. This could allow unauthorized access to the guest Wi-Fi network, potentially leading to unauthorized network usage or further attacks within the guest network segment. The vulnerability does not impact confidentiality beyond guest credentials, nor does it affect integrity or availability directly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint if possible and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.