CVE-2026-51631
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 allows unauthenticated attackers to obtain WPS runtime status via a crafted POST request to /cgi-bin/cstecgi.cgi.
Risk Assessment
Disclosure of WPS status may allow an attacker to exploit WPS weaknesses to gain access to the Wi-Fi network.
Recommendation
Update the router firmware and disable WPS if not in use.
Other vulnerabilities in TOTOLINK T6
See all- CVE-2026-51665Low risk· EPSS 7%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getTracerouteCfg function, allowing unauthenticated attackers to obtain traceroute diagnostic logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51664Low risk· EPSS 7%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getTelnetCfg function, allowing unauthenticated attackers to obtain Telnet service enablement status information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51663Low risk· EPSS 8%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getWiFiApcliScan function, allowing unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51662Low risk· EPSS 8%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getCloudSrvCheckStatus function, allowing unauthenticated attackers to obtain cloud firmware check status information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51661Low risk· EPSS 7%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getPortForwardRules function, allowing unauthenticated attackers to obtain port-forwarding rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51660Low risk· EPSS 7%
Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain IP and port filtering rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51659Low risk· EPSS 7%
Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51658Low risk· EPSS 7%
Incorrect access control in the getDmzCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51657Low risk· EPSS 7%
Incorrect access control in the getSyslogCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain syslog-related configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51656Low risk· EPSS 7%
Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Original NVD description (English source)
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi.