TOTOLINK T6 CVE-2026-51619

No authentication is required - the CVSS PR:N metric confirms this. The attacker must have network reachability to the router's HTTP management interface (typically TCP port 80 or 8080). If the management interface is exposed on the WAN interface (non-default but seen in misconfigured deployments), exploitation is possible from the internet with no local access. If management is restricted to the LAN only (the typical default), the attacker must have LAN access such as a wired or wireless connection to the router's network. No special firmware configuration, feature enablement, or user interaction is required beyond network reachability. Exploitation is strictly read-only and limited to client list disclosure; no write capability or code execution is exposed by this specific endpoint.

The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) assigns high confidentiality impact, which likely overstates real-world harm. The getOnlineClient function returns network client inventory data - device presence, MAC addresses, IP assignments - rather than administrative credentials, configuration secrets, or cryptographic material; C:L more accurately reflects this scope. The EPSS score of 0.18% (7th percentile) strongly indicates the vulnerability is not being exploited at scale, consistent with coordinated researcher disclosure of a vulnerability class rather than opportunistic threat actor activity. The absence from CISA KEV and the lack of confirmed POC further reduce operational urgency. Primary real-world risk is network reconnaissance: an attacker can silently enumerate all connected devices without any interaction from the router's users, enabling targeted follow-on attacks. If the management interface is WAN-exposed (non-default but not uncommon in misconfigured deployments), internet-based exploitation is trivial.

An attacker who can reach the router's HTTP management interface sends a POST request to /cgi-bin/cstecgi.cgi with the getOnlineClient action specified in the body, supplying no authentication credentials or session token. The router responds with a list of all currently connected clients, including their MAC addresses, IP addresses, and hostnames. Armed with this device inventory, the attacker can identify high-value targets on the network and plan tailored follow-on attacks against specific connected systems.