Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain a client… (CVE-2026-51624)

The vulnerability in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 arises from improper access control in the getStationMacByIp function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, resulting in disclosure of client MAC addresses. This information disclosure could aid attackers in network reconnaissance or further attacks.

Unauthenticated attackers can obtain client MAC addresses from the affected device. While this does not directly allow device compromise, it leaks network topology information that could facilitate targeted attacks or privacy violations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict access to the device management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi to reduce exposure.