Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ… (CVE-2026-51659)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getUrlFilterRules function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which results in disclosure of DMZ configuration details. This information disclosure could potentially aid attackers in further targeting the device or network. There is no available information about patches or fixes for this vulnerability at this time.

The impact is limited to unauthorized disclosure of DMZ configuration information. This could provide attackers with network topology or security boundary details, potentially facilitating further attacks. There is no evidence of remote code execution or direct system compromise from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device management interface from untrusted networks and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi.