Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain syslog-related… (CVE-2026-51657)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 is due to improper access control in the getSyslogCfg function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, resulting in unauthorized disclosure of syslog configuration data. No CVSS score or detailed impact metrics are provided, and no patch or remediation information is available from the source data.

The impact is unauthorized disclosure of syslog-related configuration information from the affected device. This could potentially aid attackers in further reconnaissance or exploitation but does not indicate direct control or code execution. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device management interface and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi.