Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain guest Wi-Fi… (CVE-2026-51638)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 arises from improper access control in the getWiFiGuestCfg function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, resulting in unauthorized disclosure of guest Wi-Fi configuration details.

Unauthorized disclosure of guest Wi-Fi configuration information could enable attackers to gain insights into network setup and potentially facilitate further attacks or unauthorized network access. However, no information about active exploitation or additional impact details is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, restrict access to the device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi.