Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain MAC… (CVE-2026-51655)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getMacFilterRules function. An attacker without authentication can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, resulting in unauthorized disclosure of MAC filter rules configured on the device. No CVSS score or detailed impact metrics are provided, and no patch or remediation information is available from the source data.

The impact is unauthorized disclosure of MAC filter rules, which may reveal network filtering configurations. This could aid an attacker in further reconnaissance or bypassing MAC-based access controls. There is no evidence of active exploitation in the wild or additional impacts such as remote code execution or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device management interface to trusted networks and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi.