CVE-2026-51663
Low risk· EPSS 8%Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getWiFiApcliScan function, allowing unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Risk Assessment
The risk is the disclosure of information about nearby wireless networks, which may help an attacker conduct attacks on the Wi-Fi network.
Recommendation
It is recommended to restrict access to the device management interface and update the firmware if a newer version is available.
Other vulnerabilities in TOTOLINK T6
See all- CVE-2026-51665Low risk· EPSS 7%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getTracerouteCfg function, allowing unauthenticated attackers to obtain traceroute diagnostic logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51664Low risk· EPSS 7%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getTelnetCfg function, allowing unauthenticated attackers to obtain Telnet service enablement status information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51662Low risk· EPSS 8%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getCloudSrvCheckStatus function, allowing unauthenticated attackers to obtain cloud firmware check status information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51661Low risk· EPSS 7%
TOTOLINK T6 version 4.1.5cu.748_B20211015 has incorrect access control in the getPortForwardRules function, allowing unauthenticated attackers to obtain port-forwarding rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51660Low risk· EPSS 7%
Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain IP and port filtering rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51659Low risk· EPSS 7%
Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51658Low risk· EPSS 7%
Incorrect access control in the getDmzCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51657Low risk· EPSS 7%
Incorrect access control in the getSyslogCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain syslog-related configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51656Low risk· EPSS 7%
Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51655Low risk· EPSS 7%
Incorrect access control in the getMacFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain MAC filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Original NVD description (English source)
Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results via sending a crafted POST request to /cgi-bin/cstecgi.cgi.