TOTOLINK T6 CVE-2026-51615

Network-level access to the TOTOLINK T6 management interface (TCP port 80 or 443) is required - typically available from any LAN-connected device, and from the internet if WAN-side remote management is enabled (non-default but common in misconfigured deployments). No authentication is required (PR:N confirmed by CVSS vector). The vulnerability is limited to TOTOLINK T6 firmware 4.1.5cu.748_B20211015 specifically. Impact is bounded to information disclosure only - an attacker gains LAN/DHCP configuration data but cannot modify settings, execute code, or escalate through this endpoint alone. LAN-only deployments with WAN management disabled significantly reduce the realistic attacker pool to local network access.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly captures the unauthenticated network-accessible nature and read-only impact, but C:H is likely overstated for this specific data class. LAN addressing and DHCP configuration is useful reconnaissance data but does not constitute a total confidentiality loss in the way credentials or session tokens would - C:L is more defensible. SSVC marks the vulnerability as automatable (trivial POST request, no interaction required) with partial technical impact, and exploitation status is confirmed none. EPSS at 0.18% (7th percentile) aligns with SSVC - no exploitation pressure is currently observed. Real-world risk depends heavily on whether the management interface is WAN-exposed: LAN-only exposure limits the attacker pool significantly, while remote management enabled on WAN broadens it to internet-scale. No public exploit code has been identified, though the trivial nature of the attack means no POC is needed - the exploit is implicit in the description.

An attacker with network access to the router's management port sends a POST request to http://[router-ip]/cgi-bin/cstecgi.cgi with a JSON body specifying the getLanCfg action, requiring no credentials. The router responds with the LAN IP address, subnet mask, gateway IP, DHCP pool range, and lease configuration. The attacker uses this topology data to plan targeted attacks against internal hosts, including identifying the address space for scanning or crafting spoofed DHCP responses.