TOTOLINK T6 CVE-2026-51620

The TOTOLINK T6's web management interface must be network-reachable by the attacker - accessible from the LAN by default, or from the WAN if remote management is enabled (non-default but common in SOHO deployments). No authentication is required, confirmed by PR:N in the CVSS vector. No user interaction is needed. The vulnerability is limited to firmware 4.1.5cu.748_B20211015; other versions are not confirmed affected or safe. Exploitation yields information disclosure only - the attacker cannot modify device configuration or execute code via this vulnerability alone, limiting the immediate blast radius to reconnaissance.

The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly captures that exploitation is network-accessible and requires no authentication or user interaction, with high confidentiality impact. However, impact is strictly bounded - no integrity or availability loss is possible via this path alone. EPSS at 0.18% (7th percentile) indicates low current mass-exploitation activity, and the vulnerability does not appear in CISA KEV. The information leaked - network topology and interface configuration - does not enable direct code execution but meaningfully aids reconnaissance for follow-on attacks. The practical risk is moderately elevated by the typical deployment reality of SOHO devices: they frequently face the internet with remote management inadvertently enabled and unchanged default credentials, meaning the attack surface is wider than a pure technical reading suggests. No conflict between CVSS signals and the description is present; the vector accurately reflects the conditions stated.

An attacker performing passive internet scanning identifies a TOTOLINK T6 with its management port exposed, then sends a single unauthenticated POST request to /cgi-bin/cstecgi.cgi with a payload invoking getNetInfoCfg. The router responds with network topology and interface configuration data - IP subnets, interface assignments, and network layout - without any credential challenge. The attacker uses this information to map the target's internal network structure and craft more precise follow-on attacks against devices behind the router.