Description
Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Published: 2026-08-28
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Apply temporary block
AI Analysis

Impact

An incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows an unauthenticated attacker to retrieve mesh configuration and runtime state data by sending a crafted POST request to /cgi-bin/cstecgi.cgi. This flaw permits disclosure of sensitive network configuration and operational details without requiring valid credentials.

Affected Systems

TOTOLINK T6 devices running firmware version 4.1.5cu.748_B20211015 are affected. No other vendors or products are listed.

Risk and Exploitability

The vulnerability can be exploited remotely over the local network by directing a POST request to the specified CGI endpoint; authentication is not required. The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1% suggests a low probability of active exploitation as of now. The issue is not listed in CISA KEV, implying limited known exploitation. Nonetheless, secrets disclosed could compromise network confidentiality and operational security.

Generated by OpenCVE AI on September 2, 2026 at 00:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Block external access to the /cgi-bin/cstecgi.cgi endpoint or the device’s internal IP address using firewall rules.
  • Restrict network segments that contain TOTOLINK T6 devices to trusted, internal segments and prevent remote unauthenticated access.
  • Check for and apply any firmware update from TOTOLINK that addresses the access control issue once it becomes available.

Generated by OpenCVE AI on September 2, 2026 at 00:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 00:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access to TOTOLINK T6 Mesh Configuration via getWiFiMeshConfig Endpoint

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access to TOTOLINK T6 Mesh Configuration via getWiFiMeshConfig Endpoint
Weaknesses CWE-284

Fri, 28 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink t6
Vendors & Products Totolink
Totolink t6

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink T6
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-01T16:04:26.510Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51641

cve-icon Vulnrichment

Updated: 2026-09-01T16:04:21.777Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T20:18:07.490

Modified: 2026-09-01T17:17:28.310

Link: CVE-2026-51641

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T00:30:04Z

Weaknesses