CVE-2026-51659: n/a

The vulnerability CVE-2026-51659 affects TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It is caused by improper access control in the getUrlFilterRules function, which can be exploited by unauthenticated attackers through a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Successful exploitation allows attackers to obtain sensitive DMZ configuration information. The CVSS 3.1 base score is 7.5, reflecting high severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no impact on integrity or availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An unauthenticated attacker can obtain sensitive DMZ configuration information from the affected device. This disclosure of configuration details can aid further attacks or reconnaissance but does not directly affect system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's management interfaces and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. No official remediation or temporary fix has been published at this time.