Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud… (CVE-2026-51647)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getCrpcCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to retrieve sensitive cloud remote-control status and URL information. This exposure could potentially aid further attacks or reconnaissance but does not indicate direct control or code execution. No patch or remediation details are provided in the available data.

Unauthenticated attackers can access sensitive cloud remote-control configuration information, including status and URLs, which may expose internal cloud management details. This could facilitate further targeted attacks or information gathering but does not directly indicate system compromise or control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint if possible and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi.