CVE-2026-51653: n/a

This vulnerability involves improper access control in the getStorageCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to obtain information about the storage feature state. The CVSS 3.1 vector indicates the attack requires adjacent network access, no privileges, and no user interaction, with limited confidentiality impact and no integrity or availability impact. No patch or official fix has been disclosed yet.

An attacker can gain unauthorized access to storage feature state information on affected TOTOLINK T6 devices. This information disclosure is limited to confidentiality and does not affect integrity or availability. The impact is considered medium severity due to the nature of the information exposed and the lack of required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to the device's management interface to trusted networks and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi. No official remediation or temporary fix has been published by the vendor at this time.