CVE-2026-51644: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51644 Overview

CVE-2026-51644 is an incorrect access control vulnerability in the getCrpcConfig function of the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve cloud remote-control status and URL information from the device. The flaw is categorized under [CWE-284: Improper Access Control] and requires no authentication or user interaction to exploit. Because the affected endpoint is exposed over the network, attackers can query the device directly to enumerate its cloud management posture.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive cloud remote-control configuration data from TOTOLINK T6 routers, exposing URLs and status information that support further targeting.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
Web management endpoint /cgi-bin/cstecgi.cgi

Discovery Timeline

2026-08-28 - CVE-2026-51644 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51644

Vulnerability Analysis

The TOTOLINK T6 exposes a CGI handler at /cgi-bin/cstecgi.cgi that dispatches requests to internal functions based on a topicurl or method parameter in the POST body. The getCrpcConfig function is one of these handlers and returns configuration data related to the router's cloud remote procedure call (CRPC) service. This service normally coordinates cloud-based remote management between the router and TOTOLINK's cloud infrastructure.

The handler does not enforce authentication or session checks before returning cloud remote-control status and URL information. Any host that can reach the router's HTTP management interface can retrieve this data. Vendor references and technical details are tracked in the DarkBoulder CVE coordination repository and the ShengWu00 CVE coordination repository.

Root Cause

The root cause is missing access control on the getCrpcConfig function. The CGI dispatcher in cstecgi.cgi invokes this function without verifying that the requester holds an authenticated administrative session. Sensitive configuration values are then serialized directly into the HTTP response body.

Attack Vector

An attacker sends an HTTP POST request to /cgi-bin/cstecgi.cgi with a JSON body targeting the getCrpcConfig action. The router responds with the cloud remote-control status and associated URL fields. No credentials, cookies, or CSRF tokens are validated. When the router's management interface is reachable from the WAN or from an untrusted LAN segment, exploitation can be fully remote and unauthenticated. The disclosed URLs and status flags can support downstream attacks against the router's cloud management channel or the vendor's cloud service.

No public proof-of-concept code has been verified for this CVE. See the TOTOLINK firmware download page for firmware distribution details.

Detection Methods for CVE-2026-51644

Indicators of Compromise

Unauthenticated POST requests to /cgi-bin/cstecgi.cgi referencing getCrpcConfig in the request body
HTTP 200 responses from the router containing cloud remote-control URL fields to non-administrative source addresses
Repeated probing of cstecgi.cgi handlers from external or unexpected internal source IPs

Detection Strategies

Inspect HTTP traffic to router management interfaces for POST bodies containing getCrpcConfig and correlate with the absence of a prior authenticated session
Alert on any WAN-side connections to the router's HTTP management port when management-from-WAN should be disabled
Baseline legitimate administrative activity to cstecgi.cgi and flag off-hours or high-frequency access patterns

Monitoring Recommendations

Log and retain HTTP requests reaching consumer and small-office routers, especially requests to CGI endpoints
Monitor DNS and outbound traffic from routers to unexpected cloud endpoints that may match leaked CRPC URLs
Track firmware versions across managed network devices to identify TOTOLINK T6 units running 4.1.5cu.748_B20211015

How to Mitigate CVE-2026-51644

Immediate Actions Required

Disable remote (WAN-side) management on affected TOTOLINK T6 routers until a fixed firmware is available
Restrict access to /cgi-bin/cstecgi.cgi through upstream firewall rules or network segmentation
Rotate any credentials, tokens, or cloud pairings that may be referenced by the exposed CRPC configuration
Inventory environments for TOTOLINK T6 devices running firmware 4.1.5cu.748_B20211015

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Administrators should monitor the TOTOLINK official website and the TOTOLINK firmware download page for updated firmware addressing CVE-2026-51644.

Workarounds

Place affected routers behind a perimeter firewall that blocks inbound HTTP and HTTPS to the management interface
Restrict LAN access to the router management interface to a dedicated administrative VLAN or host
Replace end-of-support or unmaintained TOTOLINK T6 units with a device that receives current security updates

bash

# Example: block inbound access to router management from the WAN using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -i <wan_iface> -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -i <wan_iface> -j DROP