CVE-2026-51623

CVE-2026-51623 is an improper access control flaw (CWE-284) in the getDdnsStatus function of TOTOLINK T6 router firmware 4.1.5cu.748_B20211015, rated 7.5 (High) with a network vector requiring no privileges or user interaction. An unauthenticated attacker triggers it by sending a crafted POST request to the router's /cgi-bin/cstecgi.cgi endpoint, bypassing the authentication that should protect this function. The attacker gains read-only disclosure of the router's DDNS runtime status and its public (WAN) IP address — there is no described impact on integrity or availability, but a leaked public IP and DDNS state are useful reconnaissance for follow-on attacks. Only TOTOLINK T6 devices running the named firmware are identified as affected; units whose web management interface is exposed to the internet are most directly reachable, though any attacker already on the LAN could also query the endpoint. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS puts the 30-day exploitation probability at 0.4% (30th percentile), so no exploitation is currently known.

What to do: Upgrade T6 firmware beyond 4.1.5cu.748_B20211015 when TOTOLINK publishes a fix (no fixed version is named in the available data, so check the vendor's download page). Until then, disable remote/WAN web management or restrict it to trusted source addresses so that unauthenticated POSTs to /cgi-bin/cstecgi.cgi cannot reach getDdnsStatus from the internet. Verify whether your unit runs the affected build and exposes its management interface on the WAN.