Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain schedule or… (CVE-2026-51654)

The TOTOLINK T6 device running firmware 4.1.5cu.748_B20211015 contains an access control vulnerability in the getScheduleCfg function. This vulnerability permits unauthenticated attackers to obtain sensitive scheduling or scheduled-reboot configuration data by issuing a specially crafted POST request to the endpoint /cgi-bin/cstecgi.cgi. The vulnerability is identified as CVE-2026-51654. No CVSS score or detailed impact metrics are available, and no official patch or mitigation guidance has been published at this time.

An attacker without authentication can access schedule or scheduled-reboot configuration information from the affected device. This could potentially expose sensitive operational details about device scheduling but does not indicate direct control or code execution capabilities based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interface to trusted users only to reduce exposure.