Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS runtime… (CVE-2026-51623)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getDdnsStatus function. By sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, an unauthenticated attacker can retrieve dynamic DNS runtime status and the device's public IP address. This information disclosure occurs due to the lack of proper authentication checks in the affected function.

An attacker can obtain sensitive network information such as the DDNS runtime status and the public IP address of the device without authentication. While this does not directly allow control over the device, it leaks information that could aid in further reconnaissance or targeted attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, network administrators should consider restricting access to the affected endpoint via network controls or firewall rules to prevent unauthenticated access.