CVE-2026-51669

CVE-2026-51669 is an incorrect access control flaw (CWE-284) in the getPairCfg function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can trigger it by sending a crafted POST request to the router's management endpoint /cgi-bin/cstecgi.cgi. On success, the attacker obtains the device's pairing and mesh-slave configuration, revealing mesh network settings that could support further attacks; the critical 9.1 CVSS score reflects that the flaw is network-exploitable with no privileges or user interaction required. Owners of TOTOLINK T6 mesh routers on the listed firmware are affected, and no fixed firmware version is identified in the available data. Exploitation status: no public proof-of-concept, no CISA KEV listing, and no known in-the-wild exploitation; EPSS estimates a roughly 0.4% chance of exploitation within 30 days.

What to do: Check TOTOLINK's support/download site for firmware newer than 4.1.5cu.748_B20211015 and upgrade as soon as a patched release is published. Until then, avoid exposing the router's web management interface (cstecgi.cgi) to the WAN — disable WAN-side management or restrict it to trusted source addresses — since exploitation requires no credentials. Defenders should treat leaked mesh pairing/slave configuration as reconnaissance that could enable follow-on attacks against the mesh network.