CVE-2026-51661: n/a

This vulnerability arises from improper access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which results in unauthorized disclosure of port-forwarding rules. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS v3.1 base score of 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to obtain sensitive port-forwarding configuration details from the affected device. This disclosure can facilitate further attacks by revealing network topology and potential entry points. The vulnerability does not impact availability but severely compromises confidentiality and integrity of the device's configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.