Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud… (CVE-2026-51644)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getCrpcConfig function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, resulting in disclosure of cloud remote-control status and URL information. This could potentially reveal sensitive configuration details related to cloud management of the device. There is no information about any available patch or fix, nor is there evidence of active exploitation in the wild.

The impact is limited to unauthorized disclosure of cloud remote-control status and URL information. This may aid attackers in reconnaissance or further targeted attacks against the device or its cloud management infrastructure. There is no indication of direct remote code execution or device takeover from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected endpoint where possible and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. No official fix or workaround has been documented in the provided data.