CVE-2026-51634
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via a crafted POST request to /cgi-bin/cstecgi.cgi.
Risk Assessment
Disclosure of SSIDs and Wi-Fi keys may allow an attacker to gain unauthorized access to the wireless network, potentially leading to confidentiality and integrity breaches.
Recommendation
Immediately update the router firmware and change all Wi-Fi passwords and the administrator password.
Other vulnerabilities in TOTOLINK T6
See all- CVE-2026-51665Low risk· EPSS 7%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getTracerouteCfg function, allowing unauthenticated attackers to obtain traceroute diagnostic logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51664Low risk· EPSS 7%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getTelnetCfg function, allowing unauthenticated attackers to obtain Telnet service enablement status information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51663Low risk· EPSS 8%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getWiFiApcliScan function, allowing unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51662Low risk· EPSS 8%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getCloudSrvCheckStatus function, allowing unauthenticated attackers to obtain cloud firmware check status information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51661Low risk· EPSS 7%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getPortForwardRules function, allowing unauthenticated attackers to obtain port-forwarding rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51660Low risk· EPSS 7%
Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain IP and port filtering rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51659Low risk· EPSS 7%
Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51658Low risk· EPSS 7%
Incorrect access control in the getDmzCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51657Low risk· EPSS 7%
Incorrect access control in the getSyslogCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain syslog-related configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51656Low risk· EPSS 7%
Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Original NVD description (English source)
Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.