TOTOLINK T6 CVE-2026-51618

Target device must be running TOTOLINK T6 firmware 4.1.5cu.748_B20211015. No authentication is required (CVSS PR:N) and no special device configuration beyond the default firmware state is needed - the getWizardCfg handler is present and unauthenticated by default. The primary limiting factor is network reachability: the management interface is LAN-facing by default, so exploitation typically requires the attacker to be on the same local network or management VLAN. If the administrator has enabled remote (WAN-side) management, the endpoint becomes reachable from the internet with no additional prerequisites, significantly expanding the attack surface. No user interaction is required.

CVSS 3.1 scores this at 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), which is appropriate for the attack vector - fully unauthenticated, single HTTP POST, no user interaction - but whether C:H is accurate hinges on what the wizard configuration actually stores. If the response includes ISP PPPoE credentials or admin setup data, C:H is defensible; if it contains only non-sensitive onboarding metadata (connection type selection, region), C:L would be more accurate, and the true score would be around 5.3. This ambiguity is not resolved by the available references. EPSS at 0.18% (7th percentile) and absence from CISA KEV indicate no observed mass or targeted exploitation. The attack is trivially automatable - a single POST with no prerequisites - so even at low EPSS the risk to any internet-exposed management interface is non-trivial. Practical exposure is typically constrained to LAN-adjacent attackers, as the TOTOLINK T6 management interface is not intended to face the internet; if remote management is disabled (default), exploitation requires local network access. Patch availability is not confirmed from the provided references, making compensating network controls the primary near-term mitigation.

An attacker connected to the same LAN as a TOTOLINK T6 device sends a POST request to http://[router-ip]/cgi-bin/cstecgi.cgi with a body specifying action=getWizardCfg. The device returns the wizard configuration object without verifying any session token or credential, potentially exposing ISP PPPoE credentials, connection type, and other onboarding parameters set during initial device setup. If remote management is enabled, this same request can be sent from the internet.