TOTOLINK T6 CVE-2026-51616

The attacker must be able to reach the router's HTTP management interface, which is accessible from any device on the LAN by default on firmware 4.1.5cu.748_B20211015. No authentication, session cookie, CSRF token, or special request headers are required - a single POST to /cgi-bin/cstecgi.cgi suffices. Limiting factors: (1) LAN-side network access is the primary requirement, as the admin interface is not exposed to the WAN by default on TOTOLINK T6; (2) the vulnerability is read-only and confined to configuration disclosure - no command execution or state modification is possible via this function; (3) confirmed scope is specific to firmware version 4.1.5cu.748_B20211015, with other firmware versions not yet assessed.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly captures the zero-barrier access path, but the C:H rating appears overstated relative to what is actually leaked - LAN addressing and DHCP configuration are reconnaissance-grade data, not authentication credentials, encryption keys, or session material, which would more clearly justify a High confidentiality rating. EPSS at 0.18% and SSVC Exploitation: none both indicate no active exploitation at time of analysis, consistent with the limited attack surface of a device not typically internet-exposed. The SSVC 'Automatable: yes' flag is technically valid given the complete absence of authentication, meaning even a mid-sized IT team in malbork managing a flat network with internet-exposed management interfaces could face opportunistic mass-scanning; in realistic deployments, however, these routers keep the admin panel LAN-side only, which substantially limits reach. Overall this represents a moderate, non-emergency priority - the data exposure is real but stops well short of granting control or enabling direct lateral movement on its own.

An attacker on the same LAN as a TOTOLINK T6 router sends a crafted unauthenticated HTTP POST request to http://[router-IP]/cgi-bin/cstecgi.cgi with the getWanIeCfg action parameter and receives WAN interface settings, LAN subnet addressing, and DHCP server configuration in the response. No credentials, tokens, or prior access are required, and the request can be scripted for automated scanning across subnets. The attacker uses the returned network map to enumerate DHCP-assigned hosts and identify high-value targets for follow-on attacks such as ARP poisoning or credential-stuffing against other LAN services.