CVE-2026-51648

CVE-2026-51648 is an incorrect access control flaw (CWE-284) in the getWanInfo function of TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. An unauthenticated attacker can trigger it by sending a crafted POST request to the router's management endpoint /cgi-bin/cstecgi.cgi, with no login or user interaction required. The attacker gains access to WAN information that the endpoint returns, such as details of the router's external network connection, which is useful for reconnaissance; per the CVSS vector the impact is confidentiality-only, with no integrity or availability effects. Operators of T6 routers running the affected firmware build are affected, especially those whose web management interface is reachable from the internet or from untrusted network segments. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS estimates only a ~0.4% chance of exploitation within 30 days, so there is no confirmed exploitation at this time.

What to do: Check whether your T6 runs firmware 4.1.5cu.748_B20211015 and monitor TOTOLINK for a patched release, as no fixed version is documented in the available data. Until then, do not expose the router's web management interface to the WAN (restrict access to trusted LAN/management segments or firewall the endpoint) and treat the exposed management API as untrusted input surface. Note that this flaw only leaks WAN-side configuration information, so prioritize it alongside any exposure of other unauthenticated cstecgi.cgi endpoints on the same device.