Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain… (CVE-2026-51633)

CVE-2026-51633 is an access control vulnerability in the TOTOLINK T6 router firmware 4.1.5cu.748_B20211015. The getWiFiEasyGuestCfg function improperly restricts access, enabling unauthenticated attackers to obtain guest Wi-Fi configuration and credentials via a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. This vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 4.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No known exploits are reported in the wild, and no patch or remediation information is currently available.

An attacker without authentication can access simplified guest Wi-Fi configuration data, including guest credentials. This exposure could allow unauthorized access to the guest Wi-Fi network, potentially leading to further network misuse or reconnaissance. The vulnerability does not impact integrity or availability, and the attacker requires adjacent network access (e.g., local network or Wi-Fi range) to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interfaces and monitor for unauthorized access attempts. Avoid exposing the device management interface to untrusted networks.