Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud… (CVE-2026-51739)

The vulnerability identified as CVE-2026-51739 involves improper access control in the CloudSrvVersionCheck function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, causing the device to perform cloud update checks without proper authorization. The CVSS 3.1 base score is 5.9, indicating a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

Successful exploitation allows unauthenticated attackers to trigger cloud update checks on the affected device. This could potentially expose sensitive information related to the update process or cloud communication, impacting confidentiality. There is no indication of impact on integrity or availability.

No patch or official remediation has been provided or referenced in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /cgi-bin/cstecgi.cgi endpoint to trusted users or networks if possible.