Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi… (CVE-2026-51667)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 is due to improper access control in the getWiFiIpMacTable function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, which results in disclosure of Wi-Fi client MAC and IP address mappings. This exposure could potentially aid attackers in network reconnaissance but does not include further details on additional impacts or exploitation methods.

Unauthenticated attackers can obtain sensitive network information, specifically the mapping between Wi-Fi client MAC addresses and their corresponding IP addresses. This information disclosure could facilitate further targeted attacks or network profiling but does not directly indicate remote code execution or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict access to the affected endpoint and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi.