Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh… (CVE-2026-51641)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the getWiFiMeshConfig function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi URI, resulting in unauthorized disclosure of mesh network configuration and runtime state data.

Unauthorized disclosure of mesh configuration and runtime state information could allow attackers to gain insights into the network setup and operational parameters. This information disclosure may facilitate further targeted attacks or network reconnaissance. No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi. Follow vendor instructions once published.