TOTOLINK T6 CVE-2026-51648

No authentication, no special configuration, and no user interaction are required - the getWanInfo endpoint responds to any unauthenticated POST request received on a network interface where the management CGI is reachable. Exploitation is constrained by network reachability: if the management interface is bound exclusively to the LAN-side interface (the common default), exploitation from the public internet is blocked unless remote management has been explicitly enabled or the device is otherwise internet-exposed. Attackers on the local network segment have unconditional access regardless of router configuration.

The CVSS 7.5 (High) vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects a low-complexity, unauthenticated, network-reachable information disclosure. The C:H rating is plausible if getWanInfo returns ISP PPPoE credentials alongside network configuration, but may be overstated if only non-sensitive connectivity parameters (IP, gateway, DNS) are exposed - this cannot be confirmed from the description alone. EPSS at 0.18% (7th percentile) indicates minimal current exploitation probability, and absence from CISA KEV confirms no observed active exploitation. SSVC classifies this as Automatable:yes with partial technical impact, meaning mass scanning for vulnerable devices is feasible but each individual hit yields limited data. Even a mid-sized municipal IT team in zabrze should treat this as urgent if their TOTOLINK T6 devices have management interfaces reachable from the internet, since WAN credential exposure directly enables ISP account takeover. The low EPSS likely reflects the narrow deployment footprint of this specific consumer router firmware rather than inherent exploitation difficulty.

An attacker sends a single unauthenticated HTTP POST request to http://[router-ip]/cgi-bin/cstecgi.cgi with a JSON body specifying the getWanInfo action; the router responds with WAN configuration data requiring no session token or credentials. If remote management is enabled or the device is internet-exposed, this is executable from anywhere on the internet with no prior foothold. Researcher disclosure repositories (github.com/DarkBoulder/CVE-Vendor-Coordination and github.com/ShengWu00/CVE-Vendor-Coordination) document this alongside multiple similar T6 endpoint flaws, suggesting coordinated proof-of-concept development.