CVE-2026-51661
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getPortForwardRules function, allowing unauthenticated attackers to obtain port-forwarding rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Risk Assessment
The risk is the disclosure of port forwarding configuration, which may help an attacker identify externally accessible services and conduct attacks against them.
Recommendation
It is recommended to restrict access to the device management interface and update the firmware if a newer version is available.
Other vulnerabilities in TOTOLINK T6
See all- CVE-2026-51665Low risk· EPSS 7%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getTracerouteCfg function, allowing unauthenticated attackers to obtain traceroute diagnostic logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51664Low risk· EPSS 7%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getTelnetCfg function, allowing unauthenticated attackers to obtain Telnet service enablement status information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51663Low risk· EPSS 8%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getWiFiApcliScan function, allowing unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51662Low risk· EPSS 8%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getCloudSrvCheckStatus function, allowing unauthenticated attackers to obtain cloud firmware check status information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51660Low risk· EPSS 7%
Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain IP and port filtering rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51659Low risk· EPSS 7%
Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51658Low risk· EPSS 7%
Incorrect access control in the getDmzCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51657Low risk· EPSS 7%
Incorrect access control in the getSyslogCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain syslog-related configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51656Low risk· EPSS 7%
Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51655Low risk· EPSS 7%
Incorrect access control in the getMacFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain MAC filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Original NVD description (English source)
Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.