Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IPTV and IGMP… (CVE-2026-51627)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 is due to improper access control in the getIptvCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, thereby obtaining IPTV and IGMP configuration details. This could potentially expose sensitive network configuration information. No further technical details or exploitation methods are provided.

An attacker without authentication can access IPTV and IGMP configuration information, which may lead to information disclosure about the network setup. The exact impact on confidentiality, integrity, or availability beyond this disclosure is not detailed. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is provided, users should monitor vendor communications for updates. Until a patch is available, restricting access to the device management interface and network segmentation may help reduce exposure.