CVE-2026-51649: n/a

This vulnerability arises from improper access control in the getDiagnosisCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which allows them to obtain sensitive diagnostic configuration data and ping logs without any authentication. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

Successful exploitation allows unauthenticated attackers to access sensitive diagnostic configuration and ping log information, potentially exposing network diagnostics and internal device state. This compromises confidentiality and integrity but does not affect availability. The high CVSS score reflects the critical nature of this information disclosure and unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected device's management interfaces from untrusted networks and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device directly to the internet.