TOTOLINK T6 CVE-2026-51651

Exploitation requires the attacker to be network-adjacent - on the same LAN segment or wireless network as the TOTOLINK T6 router (confirmed by CVSS AV:A). No authentication, credentials, special account, or non-default configuration is required; PR:N in the CVSS vector confirms unauthenticated access is sufficient. The affected firmware version is 4.1.5cu.748_B20211015. The critical limiting factor is the adjacency requirement: internet-based attackers cannot reach the endpoint unless the administrator has explicitly exposed remote management, which is non-default. Impact is strictly read-only disclosure of Smart QoS configuration; no write or availability impact is possible through this endpoint.

The CVSS 3.1 score of 4.3 (Medium) with vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the limited scope of this disclosure. The adjacent-network attack vector (AV:A) is the primary risk-limiting factor: exploitation is restricted to clients on the same LAN or Wi-Fi segment, excluding internet-based threat actors under default configurations. EPSS at 0.18% (7th percentile) signals minimal attacker interest. There is no CISA KEV listing and no public exploit has been identified. The exposed data - Smart QoS rules and associated settings - has low standalone intelligence value compared to credentials or full configuration dumps. That said, this flaw belongs to a broad family of access control failures across the TOTOLINK T6 CGI interface; an attacker already on the LAN could chain multiple such endpoints to build a fuller picture of the network topology and device inventory.

An attacker connected to the same Wi-Fi or LAN segment as the TOTOLINK T6 sends a single unauthenticated POST request to /cgi-bin/cstecgi.cgi with an action parameter invoking getSmartQosCfg. The router responds with the full Smart QoS policy configuration - including bandwidth rules and potentially associated MAC addresses - without requiring any credentials. No public exploit code has been identified, but the attack requires only a single HTTP request, making it trivially reproducible by any network-adjacent actor.