Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS… (CVE-2026-51626)

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 contains an access control flaw in the getWiFiWpsCfg function. This flaw permits unauthenticated remote attackers to obtain the Wi-Fi Protected Setup (WPS) configuration, including the active WPS PIN, by issuing a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The vulnerability arises from insufficient access control checks on this function, allowing sensitive configuration data disclosure without authentication.

An attacker can obtain the WPS PIN and configuration without authentication, potentially enabling unauthorized access to the wireless network. Disclosure of the WPS PIN undermines the security of the wireless setup, increasing the risk of network compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the router's management interface from untrusted networks and disable WPS functionality if possible to reduce exposure.