CVE-2026-51661: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51661 Overview

CVE-2026-51661 is an incorrect access control vulnerability in the getPortForwardRules function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can retrieve port-forwarding rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The flaw is classified under CWE-284: Improper Access Control and requires no privileges or user interaction. Exposure of forwarding rules reveals internal hosts, service ports, and network topology behind the router.

Critical Impact
Remote, unauthenticated attackers can enumerate port-forwarding rules on affected TOTOLINK T6 devices, exposing internal services and enabling follow-on pivoting.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
/cgi-bin/cstecgi.cgi CGI handler (getPortForwardRules)

Discovery Timeline

2026-08-28 - CVE-2026-51661 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51661

Vulnerability Analysis

The TOTOLINK T6 web management interface exposes a CGI endpoint at /cgi-bin/cstecgi.cgi that dispatches JSON-formatted commands to internal handler functions. The getPortForwardRules handler returns the router's configured port-forwarding entries, including WAN ports, LAN target IP addresses, LAN target ports, and protocol identifiers.

The handler fails to verify that the requester holds an authenticated session before returning configuration data. Any host that can reach the router's HTTP(S) service can invoke the function directly. The endpoint is reachable over the network, requires no credentials, and no user interaction is needed for exploitation.

Because port-forwarding rules describe how external traffic is mapped to internal services, disclosure gives an attacker a targeting map for the network behind the router. Combined with other exposed handlers on the same CGI, the vulnerability supports reconnaissance workflows that precede intrusion or lateral movement.

Root Cause

The root cause is missing authorization enforcement inside the getPortForwardRules handler [CWE-284]. The CGI dispatcher in cstecgi.cgi routes to sensitive configuration-read functions without checking whether the caller's session token is valid or whether the request originates from the LAN-side administrative context. Access control is not applied uniformly across handlers.

Attack Vector

Exploitation requires only network reachability to the router's web interface. An attacker sends an HTTP POST request to /cgi-bin/cstecgi.cgi with a JSON body specifying the getPortForwardRules action. The device returns the stored forwarding rules in the response body. No verified public proof-of-concept is listed in the enriched data. Refer to the CVE coordination overview on GitHub and the ShengWu00 coordination repository for additional context.

// No verified exploit code is available. See vendor coordination references for details.

Detection Methods for CVE-2026-51661

Indicators of Compromise

Unauthenticated HTTP POST requests to /cgi-bin/cstecgi.cgi from external or untrusted source addresses
Request bodies containing the string getPortForwardRules targeting the router's management interface
Web-server responses from the router containing port-forwarding rule structures returned to non-LAN clients

Detection Strategies

Inspect router access logs and upstream network telemetry for POST traffic to cstecgi.cgi invoking configuration-read handlers.
Alert on any administrative-interface requests originating from WAN-side or non-management network segments.
Baseline expected management-plane traffic and flag deviations, particularly bursts of JSON POST requests referencing configuration functions.

Monitoring Recommendations

Forward router HTTP access logs to a centralized logging platform for correlation with perimeter flow data.
Track outbound scanning behavior from hosts referenced in disclosed port-forwarding rules, which may indicate follow-on targeting.
Monitor for signs that disclosed internal services are being probed from the internet after router reconnaissance.

How to Mitigate CVE-2026-51661

Immediate Actions Required

Restrict access to the TOTOLINK T6 web administration interface to trusted LAN segments only and disable remote WAN-side management.
Place the router's management interface behind an access control list that permits only known administrative source addresses.
Review and minimize port-forwarding rules so that any disclosure exposes as little internal topology as possible.

Patch Information

No fixed firmware version is listed in the enriched NVD data at the time of writing. Check the TOTOLINK download page and the TOTOLINK official website for updated firmware for the T6 platform, and apply any release that supersedes 4.1.5cu.748_B20211015.

Workarounds

Disable remote administration and block inbound traffic to the router's HTTP(S) management ports at the perimeter.
Segment the router's management VLAN from user and guest networks to limit which hosts can reach /cgi-bin/cstecgi.cgi.
Rotate credentials and reassess exposed internal services if logs indicate the endpoint has already been queried by untrusted sources.

bash

# Example: block WAN-side access to the router's HTTP management port using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 443 -j DROP