CVE-2026-51646

CVE-2026-51646 is an improper access-control flaw (CWE-284) in the getParentalRules function of the TOTOLINK T6 router's web API, exposed at /cgi-bin/cstecgi.cgi in firmware 4.1.5cu.748_B20211015. An unauthenticated attacker who can reach the router's management interface sends a crafted POST request to that endpoint, and the device returns its parental-control rules without requiring any credentials. The direct gain is information disclosure — the rules typically reveal which websites or content are restricted, for which devices, and on what schedule — which is useful reconnaissance; the assigned CVSS 3.1 vector (9.1 critical) rates confidentiality and integrity impact as high, although the published description documents only the information-disclosure effect. Only TOTOLINK T6 units running the listed firmware build are confirmed affected (adjacent builds are unconfirmed), and TOTOLINK is a budget consumer-router brand, so exposure is concentrated in home and small-office deployments. There is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a 0.4% probability of exploitation within 30 days, so no exploitation is currently known.

What to do: Check TOTOLINK's support site for a T6 firmware release newer than 4.1.5cu.748_B20211015 and upgrade when available, since no fixed version is named in the disclosure. Until patched, do not expose the router's web management interface to the WAN (restrict it to the LAN or reach it via VPN), and consider blocking unauthenticated POST requests to /cgi-bin/cstecgi.cgi from external sources. Monitor device logs for unexpected POST traffic to cstecgi.cgi, as this endpoint is a common attack surface on TOTOLINK routers.