CVE-2026-51645

CVE-2026-51645 is an incorrect access control flaw (CWE-284) in the getPasswordCfg function of the web management interface on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can trigger it by sending a crafted POST request to /cgi-bin/cstecgi.cgi, causing the router to return the administrative username without requiring any login. Disclosing the admin username is primarily a stepping stone that enables targeted password guessing or brute-force attacks against the management interface, potentially leading to full router compromise, consistent with the critical 9.8 CVSS 3.1 rating assigned. Only TOTOLINK T6 units on the listed firmware are confirmed affected, and risk is greatest where the management interface is reachable, whether from LAN clients or from the internet. There is no public proof-of-concept, the flaw is not in CISA's KEV, and the EPSS of about 0.4% (37th percentile) indicates no confirmed exploitation so far.

What to do: Check TOTOLINK's support/download site for a T6 firmware release newer than 4.1.5cu.748_B20211015, as no fixed version is stated in the available data. Until an update is available, avoid exposing the router's web management interface to the internet, restrict administration to trusted LAN clients, and set a strong admin password since this flaw reveals the administrative username. Defenders can watch for unauthenticated POST requests to /cgi-bin/cstecgi.cgi that invoke getPasswordCfg as an indicator of probing.