Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IP and… (CVE-2026-51660)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getIpPortFilterRules function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, which results in disclosure of IP and port filtering rules configured on the device. This information disclosure could aid attackers in further targeting the device or network. No CVSS score or vendor advisory is available to confirm patch status or detailed impact.

The vulnerability allows unauthenticated attackers to obtain sensitive configuration information, specifically IP and port filtering rules, from the affected device. Disclosure of these rules may facilitate further reconnaissance or targeted attacks against the network protected by the device. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's management interface to trusted hosts only to reduce exposure. Monitor for any updates from TOTOLINK regarding patches or mitigations.