Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain… (CVE-2026-51646)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getParentalRules function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint to obtain parental-control rules. The vulnerability does not have an associated CVSS score or known exploits in the wild. No vendor advisory or patch information is currently available.

Unauthenticated attackers can access parental-control rules configured on the affected device. This may expose sensitive configuration information related to parental controls but does not explicitly indicate further compromise or control over the device. The exact impact on confidentiality or device security beyond information disclosure is not detailed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected device's management interface to trusted users only to reduce exposure.