CVE-2026-51727: n/a

This vulnerability arises from improper access control in the SystemSettings function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to retrieve administrative import and export endpoint information. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated attackers to access administrative endpoint information, which could aid in further attacks or reconnaissance. However, it does not allow modification of data or disruption of service. The confidentiality impact is limited, and there is no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected device and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. No official remediation or temporary fix is currently documented.