CVE-2026-51620: TOTOLINK T6 Information Disclosure Flaw

CVE-2026-51620 Overview

CVE-2026-51620 is an incorrect access control vulnerability [CWE-284] in the getNetInfoCfg function of the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to retrieve network topology and interface configuration data. Exploitation requires only a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint. No authentication, user interaction, or elevated privileges are needed.

Critical Impact
Unauthenticated attackers on the network can enumerate internal network topology and interface configuration, exposing reconnaissance data that enables follow-on attacks against the router and downstream hosts.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
Devices exposing the cstecgi.cgi management interface

Discovery Timeline

2026-08-28 - CVE-2026-51620 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51620

Vulnerability Analysis

The TOTOLINK T6 web management interface exposes the getNetInfoCfg handler through the CGI endpoint /cgi-bin/cstecgi.cgi. The handler returns detailed network configuration data including interface addresses, routing information, and topology metadata. The function does not verify session authentication or authorization before responding.

An attacker sends a single POST request specifying the getNetInfoCfg action. The server returns configuration data intended for administrative users. This exposes information that supports lateral movement, targeted attacks against internal hosts, and identification of additional vulnerabilities in the router firmware.

The issue affects confidentiality only. It does not directly modify device state or disrupt service. The absence of authentication on a diagnostic endpoint indicates a broader pattern of missing access checks across the CGI interface.

Root Cause

The root cause is missing authorization enforcement [CWE-284] on the getNetInfoCfg code path within cstecgi.cgi. The handler processes the POST request and returns sensitive configuration data without validating a session token, cookie, or administrative privilege.

Attack Vector

Exploitation requires network reachability to the router's HTTP management interface. An attacker on the LAN, or on the WAN if the management interface is exposed, sends a crafted POST request to /cgi-bin/cstecgi.cgi invoking the getNetInfoCfg action. The server responds with network topology and interface configuration data. No credentials or user interaction are required.

The vulnerability is documented in the vendor coordination reports published on GitHub. See the DarkBoulder TOTOLINK coordination advisory and the ShengWu00 TOTOLINK coordination advisory for technical details.

Detection Methods for CVE-2026-51620

Indicators of Compromise

Unauthenticated POST requests to /cgi-bin/cstecgi.cgi containing the getNetInfoCfg action parameter
HTTP responses from the router management interface containing interface and routing configuration returned to unauthenticated clients
Unexpected traffic to the router administrative port from hosts that do not normally administer the device

Detection Strategies

Inspect web server and reverse proxy logs for POST requests to cstecgi.cgi that lack a valid administrative session cookie
Deploy network intrusion detection signatures that match the request body pattern invoking getNetInfoCfg
Correlate reconnaissance traffic against the router with subsequent scanning of internal hosts identified in leaked topology data

Monitoring Recommendations

Monitor router management interface access logs for source addresses outside the administrative subnet
Alert on any request to cstecgi.cgi originating from WAN-side sources
Track outbound scanning activity from LAN hosts following unauthenticated router queries

How to Mitigate CVE-2026-51620

Immediate Actions Required

Restrict access to the router management interface to a dedicated administrative VLAN or trusted host list
Disable remote WAN administration on TOTOLINK T6 devices if enabled
Place affected routers behind a network segmentation boundary that blocks untrusted access to TCP management ports

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Check the TOTOLINK download page and the TOTOLINK official website for firmware updates addressing this issue. Apply firmware updates as soon as the vendor releases a fixed build for the T6 platform.

Workarounds

Block inbound access to /cgi-bin/cstecgi.cgi from untrusted networks using an upstream firewall or ACL
Enforce strong administrative segmentation so only management workstations can reach the router web interface
Replace end-of-life or unpatched TOTOLINK T6 devices with hardware that receives current security updates

bash

# Example iptables rule restricting access to the router management interface
# Allow only the administrative subnet 192.0.2.0/24 to reach the router at 10.0.0.1
iptables -A FORWARD -s 192.0.2.0/24 -d 10.0.0.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 10.0.0.1 -p tcp --dport 80 -j DROP