Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the… (CVE-2026-51645)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getPasswordCfg function. An attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, which results in disclosure of the administrative username without authentication. This could potentially aid further attacks by revealing sensitive configuration information. No further technical details or exploitation methods are provided.

The impact is limited to unauthorized disclosure of the administrative username. This information leak could facilitate subsequent attacks targeting the device's administrative interface. There is no indication of direct compromise or remote code execution from this vulnerability alone. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the device's management interface to trusted networks and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.