CVE-2026-51651: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51651 Overview

CVE-2026-51651 is an incorrect access control vulnerability in the getSmartQosCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated attackers on an adjacent network to retrieve Smart Quality of Service (QoS) configuration and rules. Exploitation requires sending a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint on the affected router. The vulnerability is categorized under [CWE-284: Improper Access Control].

Critical Impact
Unauthenticated adjacent-network attackers can extract Smart QoS configuration data from the router, exposing internal traffic policies and network topology details.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
Web management interface at /cgi-bin/cstecgi.cgi

Discovery Timeline

2026-08-28 - CVE-2026-51651 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51651

Vulnerability Analysis

The TOTOLINK T6 web management application exposes the getSmartQosCfg handler through the /cgi-bin/cstecgi.cgi Common Gateway Interface (CGI) endpoint. The handler does not verify that the caller holds an authenticated administrative session before returning Smart QoS configuration data. Any host on the adjacent network segment can invoke the function directly.

The returned payload contains device-specific QoS rules, bandwidth allocation policies, and identifiers associated with connected clients. This information supports reconnaissance and can inform follow-on attacks that target higher-value services on the same network.

Root Cause

The root cause is missing authorization enforcement inside the CGI dispatch logic. The firmware routes the getSmartQosCfg command to its handler without checking for a valid session cookie or authentication token. The access control weakness matches the pattern described by [CWE-284].

Attack Vector

Exploitation requires network adjacency, typically meaning the attacker is connected to the same LAN or wireless segment as the router. The attacker sends an HTTP POST request to /cgi-bin/cstecgi.cgi with a JSON body that sets the topicurl parameter to getSmartQosCfg. The device responds with the Smart QoS configuration in the HTTP response body. No credentials, tokens, or user interaction are required. Refer to the GitHub Coordination README for coordination details.

Detection Methods for CVE-2026-51651

Indicators of Compromise

Unauthenticated HTTP POST requests to /cgi-bin/cstecgi.cgi originating from LAN or Wi-Fi clients
Request bodies containing the string getSmartQosCfg in the topicurl field
Repeated CGI probes from a single adjacent host targeting multiple topicurl handlers

Detection Strategies

Inspect router access logs for POST requests to cstecgi.cgi that lack a prior successful authentication event
Deploy network intrusion detection signatures that match the getSmartQosCfg command string against traffic destined for the router management interface
Correlate anomalous LAN-side management-plane traffic with device inventory to identify unauthorized clients probing the router

Monitoring Recommendations

Forward router syslog output to a centralized log platform for retention and analysis
Alert on any management-plane HTTP traffic from client subnets that should not administer network infrastructure
Baseline normal QoS configuration change frequency and flag out-of-band read requests

How to Mitigate CVE-2026-51651

Immediate Actions Required

Restrict management interface access to a dedicated administrative VLAN or trusted host list
Disable remote management features that are not required for daily operation
Segment guest and untrusted Wi-Fi networks from the router's management subnet

Patch Information

No vendor patch has been referenced in the public advisory at the time of publication. Monitor the TOTOLINK Download Page and the TOTOLINK Official Site for firmware updates that address the getSmartQosCfg authorization gap.

Workarounds

Place the TOTOLINK T6 router behind a firewall that blocks LAN-side access to /cgi-bin/cstecgi.cgi from non-administrative hosts
Enforce strong Wi-Fi authentication (WPA2/WPA3) to reduce the pool of adjacent-network attackers
Replace the affected device with a supported model if a firmware fix is not available
Audit exposed QoS and configuration data and rotate any sensitive identifiers referenced in the disclosed rules

bash

# Example: block LAN clients from reaching the router CGI endpoint using an upstream firewall
iptables -I FORWARD -p tcp -d <router_ip> --dport 80 \
  -m string --string "/cgi-bin/cstecgi.cgi" --algo bm -j DROP