CVE-2026-51658: n/a

The vulnerability identified as CVE-2026-51658 affects TOTOLINK T6 version 4.1.5cu.748_B20211015. It arises from improper access control in the getDmzCfg function, which can be triggered by an unauthenticated attacker sending a specially crafted POST request to the endpoint /cgi-bin/cstecgi.cgi. Successful exploitation results in disclosure of the DMZ configuration information. The CVSS v3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An unauthenticated attacker can obtain sensitive DMZ configuration details from the affected device, potentially aiding further attacks or reconnaissance. The confidentiality of the device's network configuration is compromised, but there is no direct impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.