Description
Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Published: 2026-08-28
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an incorrect access control in the getLanCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. A crafted POST request to /cgi-bin/cstecgi.cgi allows any unauthenticated user to retrieve LAN addressing and DHCP configuration data, exposing sensitive network configuration.

Affected Systems

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected. No other product versions are listed in the CNA data.

Risk and Exploitability

An attacker with network access to the device can exploit this flaw by sending a simple HTTP POST request, circumventing authentication entirely. While no CVSS or EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the information disclosure can aid attackers in mapping the network, potentially escalating to further attacks.

Generated by OpenCVE AI on August 28, 2026 at 20:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and install the latest firmware from the vendor that addresses the access control issue.
  • Restrict network access to the router's management interface by configuring firewall rules or placing the device on a separate VLAN.
  • Disable or remove the /cgi-bin/cstecgi.cgi endpoint if not required, or enforce authentication on that endpoint via HTTP Basic/Digest or ACL.
  • Verify network perimeter security and change unused default credentials.

Generated by OpenCVE AI on August 28, 2026 at 20:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink t6
Vendors & Products Totolink
Totolink t6

Fri, 28 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Access to LAN Configuration via POST on TOTOLINK T6
Weaknesses CWE-200
CWE-284

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink T6
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-28T15:41:45.590Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51615

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-28T20:18:04.647

Modified: 2026-08-28T21:20:39.190

Link: CVE-2026-51615

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T22:30:17Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control