TOTOLINK T6 CVE-2026-51644

No authentication is required; the /cgi-bin/cstecgi.cgi endpoint accepts getCrpcConfig requests from any network-reachable host without validating credentials, consistent with CVSS PR:N and the 'Authentication Bypass' tag. The router must be reachable over the network from the attacker's position - exposure is highest when the management interface is accessible on the WAN interface, but LAN-side attackers (e.g., compromised internal hosts) are equally capable. The cloud remote-control (CRPC) feature must be configured or initialized for the response to carry a meaningful management URL; if CRPC is unconfigured, the disclosure is limited to the enable-status flag. Exploitation is bounded to information disclosure only - this endpoint exposes no write or code-execution capability.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a fully remote, zero-authentication read exposure, and the C:H rating is defensible if the leaked cloud management URL enables follow-on attacks against TOTOLINK's backend or the device's cloud control plane. In practice, the disclosed data - CRPC status and a URL string - is not equivalent to credential or key material disclosure, so real-world impact is more constrained than the raw score implies. EPSS at the 7th percentile and absence from the CISA KEV catalog confirm that exploitation is not observed in the wild; even a mid-sized municipal IT team in leszno managing TOTOLINK T6 branch routers should treat this as a routine patch cycle item rather than an emergency response. The primary threat model is an attacker using the exposed cloud URL to map backend infrastructure or to chain this disclosure with a subsequent, more impactful exploit against the management plane.

An attacker with network reach to the router's management interface sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking the getCrpcConfig action; the router responds without credential validation, returning the CRPC enable flag and the cloud management server URL. The attacker uses this URL to probe TOTOLINK's cloud backend, enumerate management endpoints, or refine a subsequent attack against the device's remote-management plane. No public exploit code is identified at time of analysis, but exploitation requires only a standard HTTP client and knowledge of the parameter structure.