TOTOLINK T6 CVE-2026-51659

No authentication is required and no special non-default configuration is needed beyond a reachable TOTOLINK T6 management interface running firmware 4.1.5cu.748_B20211015. Exploitation requires network-level access to the router's HTTP management port (typically port 80 or 8080). If WAN-side remote management is enabled, the device is exploitable directly from the internet with no prior access; this is the highest-risk configuration. On default configurations where management is restricted to LAN, an attacker must first obtain local network access. The vulnerability is strictly read-only and limited to DMZ configuration data - no code execution, authentication bypass for admin access, or configuration modification is achievable through this endpoint alone.

CVSS 3.1 rates this 7.5 (High) with a fully unauthenticated network vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), which accurately reflects the ease of exploitation against a reachable device. Real-world risk is moderated by several converging signals: EPSS is 0.18% (7th percentile), indicating very low observed exploitation probability; SSVC marks exploitation status as none with only partial technical impact; and no CISA KEV listing exists. SSVC's automatable:yes flag is consistent with the trivial single-request attack mechanic. The disclosed data - DMZ forwarding configuration - has secondary intelligence value in mapping internal hosts for follow-on attacks, but yields no direct code execution, configuration change, or availability impact. Risk is most meaningful for internet-exposed devices with WAN-side management enabled; LAN-only deployments require prior network access, substantially reducing attacker reach.

An attacker who can reach the router's HTTP management port - from the LAN, or from the internet if WAN-side management is enabled - sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking the getUrlFilterRules action without any credentials. The router responds with DMZ configuration data including forwarded internal host IP addresses and ports, which the attacker uses to identify internal hosts for subsequent lateral movement or targeted exploitation.