CVE-2026-51613: TOTOLINK T6 Authentication Bypass Flaw

CVE-2026-51613 Overview

CVE-2026-51613 is an incorrect access control vulnerability affecting TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015. The flaw resides in the getDeviceInfo function exposed through the /cgi-bin/cstecgi.cgi endpoint. Unauthenticated attackers on an adjacent network can obtain device identification details by sending a crafted POST request to the vulnerable endpoint. The weakness is categorized under CWE-284: Improper Access Control.

Critical Impact
An adjacent-network attacker can retrieve sensitive device identification information from a TOTOLINK T6 router without authentication, enabling reconnaissance for follow-on attacks against the device or connected network segment.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
Endpoint /cgi-bin/cstecgi.cgi handler for getDeviceInfo

Discovery Timeline

2026-08-28 - CVE-2026-51613 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51613

Vulnerability Analysis

The vulnerability exists in the getDeviceInfo handler served by the cstecgi.cgi binary on the TOTOLINK T6 router. The handler processes POST requests without validating whether the requester holds an authenticated session. As a result, any client with network reachability to the router's web management interface can invoke the function and receive device identification data in response.

The disclosed information supports attacker reconnaissance. Device model, firmware, and identification fields allow adversaries to fingerprint the target and correlate it with other known TOTOLINK vulnerabilities. This narrows exploit selection for chained attacks against the same device.

The attack requires adjacent-network access, meaning the attacker must be on the same logical network segment such as the local wireless or wired LAN. No user interaction and no privileges are required.

Root Cause

The root cause is missing authentication and authorization checks in the getDeviceInfo code path within cstecgi.cgi. The CGI dispatcher routes the request to the information-disclosure function without first verifying a valid session token, cookie, or credential. This is a classic broken access control pattern where a sensitive read operation is treated as a public endpoint.

Attack Vector

An attacker with adjacent-network access sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with a JSON body invoking the getDeviceInfo topic. The router responds with device identification details even though no authentication cookie or token is presented. The response can then be parsed to identify hardware model, firmware build, and other fields useful for planning subsequent exploitation.

No public proof-of-concept exploit code has been verified in the enriched data. See the vendor coordination notes on GitHub and the TOTOLINK firmware portal for additional context.

Detection Methods for CVE-2026-51613

Indicators of Compromise

Unauthenticated POST requests to /cgi-bin/cstecgi.cgi referencing the getDeviceInfo topic from LAN clients.
HTTP 200 responses from the router containing device model and firmware identification fields returned to clients without a valid session cookie.
Repeated probing of cstecgi.cgi from a single LAN host across short time windows, indicating enumeration.

Detection Strategies

Inspect router web logs, where available, for POST requests to cstecgi.cgi that lack an authenticated session context.
Deploy network-based signatures on internal segments to flag HTTP POST bodies containing the getDeviceInfo topic string directed at TOTOLINK management interfaces.
Correlate LAN reconnaissance activity with subsequent authentication attempts or configuration changes on the same router.

Monitoring Recommendations

Monitor east-west traffic on network segments where TOTOLINK T6 devices are deployed for unexpected access to the router management interface.
Alert on any host, other than administrative workstations, that initiates requests to /cgi-bin/cstecgi.cgi.
Track firmware version fingerprints exposed on the LAN to identify unauthorized reconnaissance patterns.

How to Mitigate CVE-2026-51613

Immediate Actions Required

Restrict access to the router web management interface to trusted administrative hosts or VLANs using access control lists.
Disable remote management on the WAN interface and limit LAN-side management to a dedicated administrative subnet.
Rotate router administrative credentials and audit account activity following exposure.
Inventory all TOTOLINK T6 devices running firmware 4.1.5cu.748_B20211015 and prioritize them for remediation.

Patch Information

No fixed firmware version is referenced in the enriched CVE data at time of publication. Check the TOTOLINK official website and the TOTOLINK firmware download portal for updated firmware releases that address the getDeviceInfo access control issue.

Workarounds

Segment TOTOLINK T6 devices onto isolated management VLANs to reduce adjacent-network exposure.
Apply firewall rules on upstream switches to block LAN clients from reaching the router management port except from approved administrator IP addresses.
Replace end-of-life TOTOLINK T6 units with actively maintained hardware if a vendor patch does not become available.

bash

# Example: restrict access to the router management interface on an upstream Linux gateway
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP