CVE-2026-51669: n/a

The vulnerability CVE-2026-51669 affects TOTOLINK T6 version 4.1.5cu.748_B20211015. Due to improper access control in the getPairCfg function, an unauthenticated attacker can send a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to obtain sensitive pairing and mesh-slave configuration information. This flaw is classified under CWE-284 (Improper Access Control) and has a CVSS v3.1 score of 9.1, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to access sensitive configuration data related to device pairing and mesh network slaves. This exposure can compromise the confidentiality and integrity of the device's network configuration, potentially enabling further attacks or unauthorized network access. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected device's management interfaces and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.