Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh… (CVE-2026-51642)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getMeshRoutingTable function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, which results in unauthorized disclosure of mesh routing information. This exposure could potentially aid attackers in network reconnaissance but does not indicate direct control or modification capabilities.

Unauthenticated attackers can retrieve sensitive mesh routing information from the affected device. This information disclosure could facilitate further attacks or network mapping but does not directly allow system compromise or control based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, restrict access to the device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi.