What is the CVSS score of CVE-2026-51646?

CVE-2026-51646 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-51646?

Within 24 hours, identify and inventory all TOTOLINK T6 routers on the network, particularly those in management or security-sensitive segments. Within 7 days, implement network access controls to restrict access to the router's admin interface (/cgi-bin/cstecgi.cgi) to authorized administrative staff only using firewall rules or network segmentation; consider temporarily disabling parental-control features if not in active use. Within 30 days, contact TOTOLINK for firmware availability or evaluate replacement with a vendor offering security patch support; document all affected firmware versions (4.1.5cu.748_B20211015 and earlier) and test firmware updates in a controlled environment before deployment.

TOTOLINK T6 CVE-2026-51646

EUVD-2026-67920 CRITICAL

Improper Access Control (CWE-284)

2026-08-28 mitre

GHSA-49jh-9cvx-g4v9

Authentication Bypass

9.1

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach router web interface (LAN or exposed WAN)
Exploit

Send crafted POST to /cgi-bin/cstecgi.cgi getParentalRules
Execution

Bypass absent access control
Impact

Read back parental-control rules

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network reachability to the router's HTTP management service and the ability to POST to /cgi-bin/cstecgi.cgi invoking the getParentalRules function on firmware 4.1.5cu.748_B20211015 - no authentication, credentials, or user interaction are needed (AV:N/AC:L/PR:N/UI:N). Limiting factors: by default the web admin interface is LAN-only, so remote (WAN) exploitation depends on the operator having enabled remote management or otherwise exposing the interface; impact is bounded to disclosure of parental-control rules and does not grant configuration change or code execution.
Impact	The input CVSS 9.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H) overstates real impact: the described behavior is a read-only disclosure of parental-control rules via getParentalRules, so the I:H (high integrity) component is unsupported and confidentiality impact is modest (policy metadata, not credentials or full configuration). A more defensible assessment is roughly CVSS 5.3 (low confidentiality only). Exploitation is trivially remote and unauthenticated (AV:N/AC:L/PR:N), which is the genuinely notable factor, but EPSS is only 0.18% (7th percentile), there is no KEV listing, and no public POC - signals that point to limited, non-widespread interest. Netting these signals, this is a low-to-moderate real-world priority: easy to trigger but low information value; a mid-sized operator running exposed T6 units should still patch or restrict management access, but this is not an emergency relative to write/RCE-class flaws on the same device.
Exploit ScenarioDerived	An attacker who can reach the router's web interface (LAN, or WAN if remote management is exposed) sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking getParentalRules with no authentication, and receives the configured parental-control rules in the response. This requires no user interaction and low complexity, but yields only policy information; no public exploit code is currently identified.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 01, 2026

Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers read the device's parental-control rules by sending a crafted POST request to the getParentalRules handler on /cgi-bin/cstecgi.cgi. The endpoint lacks any access-control check, so no credentials are required. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.

RemediationAI

No vendor-released patched firmware version is identified in the provided data at time of analysis; the TOTOLINK references point to the general product/download pages rather than a specific fixed build, so check https://www.totolink.net/ for firmware newer than 4.1.5cu.748_B20211015 and apply it once available. As compensating controls, ensure the router's web/CGI management interface (/cgi-bin/cstecgi.cgi) is not reachable from the WAN - disable remote/WAN management, which has no impact on normal LAN administration; and restrict LAN-side access to the admin interface to trusted hosts or a management VLAN, at the cost of some administrative convenience. Because the exposed data is parental-control policy only, prioritizing this behind more severe cstecgi.cgi issues on the same firmware is reasonable. Coordination references: https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md and https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md .

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is the cstecgi.cgi CGI binary that fronts the T6's web administration interface; requests are dispatched by a topicurl/function selector (here getParentalRules). The root cause is CWE-284 (Improper Access Control): a sensitive read operation is reachable without authenticating, exposing configured parental-control policy data. This is a recurring pattern across TOTOLINK cstecgi.cgi handlers, where individual functions omit session validation. The supplied CPE (cpe:2.3:a:n/a:n/a) is a non-informative placeholder and does not identify the product; the true affected product is the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI 5.3 MEDIUM

Remote unauthenticated read of parental-control rules gives limited confidentiality impact (C:L); no integrity or availability effect, so I:N/A:N - the input I:H is unsupported.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Sep 01, 2026 - 17:22 NVD

9.1 (CRITICAL)

CVE Published

Aug 28, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 28, 2026 - 00:00 cve.org

CRITICAL 9.1

DescriptionCVE.org

Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive ViewAI

Why It Matters

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 expose parental control policies to any remote attacker without authentication, revealing organizational internet access policies and device management settings. No public exploit has been identified at time of analysis, and the actual impact remains limited to information disclosure despite the critical CVSS rating.

Business Impact: Medium

Compensating Controls

No vendor-released patch identified at time of analysis. Implement network-level mitigations: restrict Layer 3/4 access to the router's admin interface using firewalls or VLANs; disable parental-control features if not operationally required; enable router access logging to detect exploitation attempts; consider air-gapping affected routers from untrusted networks or planning replacement with patched models.

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Prevalence

Low

consumer SOHO router from a niche vendor, limited enterprise footprint

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.