CVE-2026-51650: n/a

The vulnerability CVE-2026-51650 affects TOTOLINK T6 firmware 4.1.5cu.748_B20211015. Due to improper access control in the getRemoteCfg function, an unauthenticated attacker can send a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to obtain information about remote management enablement and port settings. This exposure could aid attackers in further targeting the device or network. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality with no impact on integrity or availability. No official patch or remediation guidance is currently available.

An unauthenticated attacker can obtain sensitive configuration information related to remote management on the affected TOTOLINK T6 device. This disclosure of remote-management enablement and port information could facilitate further attacks or unauthorized access attempts. The vulnerability impacts confidentiality but does not affect integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.