Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing… (CVE-2026-51616)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 is due to improper access control in the getWanIeCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to the endpoint /cgi-bin/cstecgi.cgi, which results in disclosure of LAN addressing and DHCP configuration data. This information disclosure could aid further attacks but does not directly allow system compromise. No CVSS score or patch information is available from the source data.

Unauthenticated attackers can obtain sensitive network configuration details such as LAN addressing and DHCP settings. This information disclosure may facilitate reconnaissance and subsequent targeted attacks on the affected network. There is no indication of direct system compromise or control from this vulnerability alone. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restricting access to the affected endpoint and monitoring for suspicious POST requests may reduce exposure. Users should consult TOTOLINK for updates or firmware patches addressing this issue.