CVE-2026-51646: n/a

The vulnerability CVE-2026-51646 affects TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It is caused by improper access control in the getParentalRules function, which can be exploited by unauthenticated attackers through a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Successful exploitation allows attackers to obtain parental-control rules, potentially exposing sensitive configuration data. The CVSS v3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact.

An unauthenticated attacker can access parental-control rules on the affected device, leading to disclosure of potentially sensitive configuration information. The vulnerability does not impact availability. The high CVSS score indicates a critical risk to confidentiality and integrity of the device's parental control settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor vendor communications for updates and consider restricting network access to the device's management interface until a fix is available.