Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain VPN… (CVE-2026-51656)

The vulnerability in TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 involves improper access control in the getVpnPassCfg function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling them to obtain sensitive VPN pass-through and WAN ping filter configuration settings. This exposure could potentially aid attackers in further reconnaissance or exploitation but does not directly indicate remote code execution or denial of service. No official patch or mitigation details have been disclosed.

Unauthenticated attackers can access VPN pass-through and WAN ping filter settings, potentially exposing network configuration details that could facilitate further attacks or reconnaissance. There is no indication of direct compromise or system control from this vulnerability alone. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device management interface and monitor for unusual POST requests to /cgi-bin/cstecgi.cgi. Follow vendor updates for official patches or workarounds.