TOTOLINK T6 CVE-2026-51735

No special configuration is required - the vulnerability exists in the default firmware of TOTOLINK T6 4.1.5cu.748_B20211015 and requires only that the attacker can send an HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint. CVSS PR:N confirms no authentication is needed. The primary limiting factor is network reachability: the management interface must be accessible from the attacker's position. In typical SOHO deployments, the management interface is bound to the LAN interface only, restricting exploitation to local network attackers or those who have already gained a foothold on the LAN. If remote management is enabled, the attack is trivially executable from the internet with no authentication, no user interaction, and no special tooling beyond a standard HTTP client.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the network-accessible, zero-authentication nature of this information disclosure. No KEV listing and no EPSS score were provided in the input data, so exploitation probability cannot be quantified. No public exploit code was referenced, though two GitHub CVE coordination repositories (DarkBoulder and ShengWu00) indicate researcher-level visibility, which elevates the likelihood of proof-of-concept development. Real-world risk is bounded by whether the router's management interface is exposed to the internet - most SOHO deployments restrict management to the LAN, which significantly reduces the attack surface. However, routers misconfigured with WAN-accessible management panels, or an attacker already on the local network, face a trivially exploitable path with no technical barrier. The C:H rating is justified because system logs can reveal credentials (e.g., PPPoE passwords, Wi-Fi passphrases logged during setup), connected device details, and admin actions, making this useful for reconnaissance or credential harvesting in a chained attack.

An attacker with network access to the router's management interface sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with a body invoking the showSyslog action, receiving the device's recent system log output in the response without providing any credentials. The attacker parses the log for sensitive details such as LAN IP assignments, admin login events, or connection metadata to support further reconnaissance or lateral movement. No authentication bypass technique is required since the access control check is entirely absent in the showSyslog function.