Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN information… (CVE-2026-51648)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getWanInfo function. An attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which returns WAN information without requiring authentication. This exposure of network configuration data could aid attackers in further reconnaissance or targeted attacks. There is no available CVSS score or detailed vendor advisory specifying patch status or mitigation.

Unauthenticated attackers can obtain WAN information from the affected device, potentially revealing network configuration details. This information disclosure could facilitate further attacks or network reconnaissance but does not directly indicate remote code execution or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device management interface from untrusted networks and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi.