CVE-2026-51660

CVE-2026-51660 is an improper access control flaw (CWE-284) in the getIpPortFilterRules function of the TOTOLINK T6 router's web management API, rated critical at CVSS 9.1. An unauthenticated attacker who can reach the router's admin interface sends a crafted POST request to /cgi-bin/cstecgi.cgi and obtains the device's IP and port filtering rules without any credentials or user interaction. The attacker gains disclosure of the router's filter configuration, revealing internal IPs and allowed/blocked ports that are useful for follow-up reconnaissance. Confirmed affected is the TOTOLINK T6 running firmware 4.1.5cu.748_B20211015, with exploitation possible wherever the admin CGI endpoint is network-reachable (WAN-exposed or LAN-adjacent). No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; the 0.4% EPSS (30th percentile) suggests low near-term exploitation likelihood.

What to do: Restrict the T6's web management interface to the LAN or trusted hosts (disable WAN-side HTTP management) so unauthenticated requests to /cgi-bin/cstecgi.cgi cannot reach getIpPortFilterRules. Check TOTOLINK's support site for a firmware update addressing this build; no fixed version is specified in available data. Review current IP and port filtering rules, since these are readable by unauthenticated users on reachable deployments.