Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain… (CVE-2026-51650)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getRemoteCfg function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, thereby obtaining sensitive configuration details related to remote management, including enablement status and port information. This exposure could potentially aid attackers in further targeting the device or network. There is no CVSS score or detailed vendor advisory available at this time.

Unauthenticated attackers can obtain sensitive remote management configuration information, which may facilitate further attacks or unauthorized access attempts. The exposure of remote-management enablement and port details could weaken the security posture of affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device management interface from untrusted networks and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi.