CVE-2026-51645: n/a

This vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 arises from improper access control in the getPasswordCfg function. An attacker without authentication can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to obtain the administrative username. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently provided.

Successful exploitation allows unauthenticated attackers to disclose the administrative username, which could facilitate further attacks against the device. The vulnerability impacts confidentiality, integrity, and availability, as indicated by the CVSS vector. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.