Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain AP-specific… (CVE-2026-51639)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 is due to improper access control in the getApWiFiSchCfg function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, which results in disclosure of AP-specific Wi-Fi scheduling configuration data. No CVSS score or detailed impact metrics are provided in the source data.

Unauthenticated attackers can obtain sensitive configuration information related to Wi-Fi scheduling rules on the affected device. This information disclosure could potentially aid attackers in further reconnaissance or targeted attacks against the device or network. There is no indication of remote code execution or denial of service from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict access to the device management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi.