CVE-2026-51625

CVE-2026-51625 is an incorrect access control flaw (CWE-284) in the getWiFiEasyCfg function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can trigger it by sending a crafted POST request to the router's management endpoint /cgi-bin/cstecgi.cgi, without needing any credentials or user interaction. Successful exploitation discloses sensitive wireless configuration data, including the network SSIDs and the Wi-Fi keys (pre-shared passwords). Any TOTOLINK T6 device on this firmware is affected, and exposure is highest when the router's web management interface is reachable from the WAN/internet; an attacker who learns the Wi-Fi keys could join the wireless network. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at about 0.4%, so no in-the-wild exploitation is known.

What to do: Check whether your T6 runs firmware 4.1.5cu.748_B20211015 and contact TOTOLINK support for a corrected firmware, as no fixed version is specified in the available data. As a mitigation, do not expose the router's management interface (port 80/443 on the WAN side) or /cgi-bin/cstecgi.cgi to the internet, and restrict remote administration. If the device may have been exposed, consider rotating the Wi-Fi passwords, since SSIDs and Wi-Fi keys are what the flaw discloses.