TOTOLINK T6 CVE-2026-51663

Exploitation requires network reachability to the router's HTTP management service and the ability to POST to the /cgi-bin/cstecgi.cgi endpoint with the getWiFiApcliScan function selector; no credentials, tokens, or user interaction are needed (CVSS PR:N/UI:N). Limiting factors: the target must be the TOTOLINK T6 on firmware 4.1.5cu.748_B20211015, and the management interface must be reachable from the attacker - on default consumer deployments this is typically LAN/adjacent rather than internet-facing, so real-world exposure depends on whether WAN-side remote management is enabled.

Signals conflict. The published CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the described capability is limited to triggering a wireless scan and reading AP-client scan results - a read-only disclosure/action, not full compromise; the C:H/I:H/A:H impact metrics appear overstated for this behavior. EPSS is low (0.18%, 8th percentile) and SSVC exploitation status is 'none' (no observed exploitation), which argues against imminent mass exploitation despite the automatable=yes / technical-impact=total SSVC ratings. There is no KEV listing and no public exploit identified. Net: genuinely reachable pre-auth on the network path, but real-world impact is closer to sensitive information exposure / nuisance scan-triggering than the headline 9.8 suggests. Note the AV:N assumption - router management interfaces are typically LAN/adjacent, so internet-facing exposure depends on whether the web UI is reachable from the WAN.

An attacker on the same network (or via an internet-exposed management interface) sends a crafted unauthenticated POST to /cgi-bin/cstecgi.cgi invoking getWiFiApcliScan, forcing the router to run a wireless scan and returning nearby AP/client details to the attacker. Given AC:L and no authentication, the request is trivial to script; no public PoC is currently identified.