Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain UPnP enablement… (CVE-2026-51652)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getUPnPCfg function. An attacker without authentication can exploit this by sending a specially crafted POST request to /cgi-bin/cstecgi.cgi, which results in disclosure of UPnP configuration details including whether UPnP is enabled and the port-mapping information parsed by the device. This information disclosure could aid attackers in understanding network configurations but does not directly indicate further exploitation capabilities.

Unauthenticated attackers can obtain sensitive UPnP configuration information, including enablement status and port mappings. This exposure could facilitate reconnaissance activities by revealing network setup details, potentially aiding in planning further attacks. There is no indication from the provided data that this vulnerability allows direct control or modification of device settings or network traffic.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix or vendor advisory, users should monitor for updates from TOTOLINK and consider restricting access to the affected endpoint or network segments to trusted users only.