TOTOLINK T6 CVE-2026-51650

No special conditions are required beyond network reachability of the router's web management interface - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation against the default-enabled HTTP interface on TOTOLINK T6 firmware 4.1.5cu.748_B20211015. The specific limiting factor is that exploitation yields only remote-management port and enablement data, not credentials or direct control; meaningful damage requires chaining this with a follow-on attack against the disclosed service. Exposure is limited to devices where the router's management interface (port 80 or equivalent) is reachable from untrusted networks.

CVSS 7.5 (C:H) reflects unauthenticated network access with no complexity, but the actual confidentiality impact is moderate at best - the function discloses only remote-management enablement status and the listening port, not credentials or session material, which makes C:H a likely overstatement for this specific endpoint. EPSS at 0.18% (7th percentile) and SSVC exploitation status of 'none' both indicate no observed exploitation pressure despite the low barrier to attack. The SSVC 'Automatable: yes' classification is accurate, since the POST request structure is trivial to replicate at scale; even a mid-sized municipal IT team in radom running unpatched TOTOLINK devices on their perimeter should treat this as an enumeration risk enabling follow-on targeting of remote-administration services. The primary real-world risk is reconnaissance: an attacker who learns the remote-management port is open can pivot to credential-stuffing or interface exploitation against that service. No KEV listing and no public POC further reduce urgency, though the automatable nature means opportunistic mass-scanning is plausible.

An unauthenticated attacker sends a crafted HTTP POST request to the router's publicly accessible /cgi-bin/cstecgi.cgi endpoint with parameters invoking getRemoteCfg. The router responds with its remote-management configuration including the enabled/disabled state and the listening port number. The attacker uses this information to confirm the remote management interface is active and to target it directly for credential attacks or known interface vulnerabilities.