What is the CVSS score of CVE-2026-51627?

CVE-2026-51627 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of TOTOLINK T6 are affected by CVE-2026-51627?

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 expose IPTV server addresses, multicast group assignments, and IGMP proxy settings to any network-adjacent attacker without authentication.

How to fix or mitigate CVE-2026-51627?

Within 24 hours, identify all TOTOLINK T6 routers on the network and confirm firmware version 4.1.5cu.748_B20211015 is in use. Within 7 days, block external access to the CGI web interface via firewall rules, segregate affected routers to a restricted management network, and disable the web management interface if not operationally required. Within 30 days, monitor TOTOLINK security advisories for firmware updates; if no patch is released, evaluate router replacement or implement permanent network isolation for affected units.

TOTOLINK T6 CVE-2026-51627

EUVD-2026-67897 HIGH

Improper Access Control (CWE-284)

2026-08-28 mitre

GHSA-57gf-r7m5-cq4x

Authentication Bypass TOTOLINK

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

IPTV/IGMP config (multicast groups, server IPs, VLAN IDs) is lower sensitivity than credentials, warranting C:L; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 01, 2026 - 17:40 vuln.today

tag: N A replaced by TOTOLINK

Analysis Generated

Sep 01, 2026 - 17:27 vuln.today

CVSS changed

Sep 01, 2026 - 17:22 NVD

7.5 (HIGH)

CVE Published

Aug 28, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 28, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

AnalysisAI

Unauthenticated IPTV and IGMP configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve multicast group settings, IPTV server parameters, and IGMP proxy configuration without credentials. The getIptvCfg function in the router's CGI web interface fails to enforce access control, accepting a crafted POST to /cgi-bin/cstecgi.cgi and returning configuration data to unauthenticated callers. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No authentication or special configuration is required - the vulnerability is present in the default firmware and exploitable by any attacker who can reach the router's web management interface on the local network or internet. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The assigned CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) reflects network-reachable, unauthenticated information disclosure with no exploitation complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Check the TOTOLINK T6 firmware download page at https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html for a firmware update addressing this and related access-control deficiencies across the getIptvCfg and other CGI functions; no specific patched firmware version has been confirmed from the available references. … Detailed patch versions, workarounds, and compensating controls in full report.