CVE-2026-51660: n/a

The vulnerability CVE-2026-51660 affects TOTOLINK T6 version 4.1.5cu.748_B20211015. Due to improper access control in the getIpPortFilterRules function, unauthenticated attackers can send specially crafted POST requests to the /cgi-bin/cstecgi.cgi endpoint to obtain sensitive IP and port filtering rules. This exposure compromises confidentiality and integrity of the device's filtering configurations. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported.

An attacker can remotely and without authentication access sensitive IP and port filtering rules from the affected TOTOLINK T6 device. This can lead to disclosure of network filtering configurations and potential manipulation or reconnaissance activities. The vulnerability impacts confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.