CVE-2026-51664: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51664 Overview

CVE-2026-51664 is an incorrect access control vulnerability [CWE-284] in the getTelnetCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers on an adjacent network can query the Telnet service enablement status by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The flaw exposes device configuration information without requiring credentials or user interaction.

Critical Impact
An adjacent-network attacker can determine whether Telnet is enabled on the router, aiding reconnaissance for follow-on attacks against exposed management services.

Affected Products

TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015
The getTelnetCfg handler within /cgi-bin/cstecgi.cgi
Deployments exposing the router web management interface to adjacent networks

Discovery Timeline

2026-08-28 - CVE-2026-51664 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51664

Vulnerability Analysis

The TOTOLINK T6 router exposes a Common Gateway Interface (CGI) endpoint at /cgi-bin/cstecgi.cgi that dispatches requests to internal handler functions based on POST parameters. The getTelnetCfg handler returns the Telnet service configuration, including whether the daemon is enabled. The handler does not verify that the requester is authenticated or authorized before returning the configuration data.

An attacker on the same wireless or wired segment as the device can issue a crafted POST request and receive the Telnet enablement state in the response. The disclosed information supports reconnaissance workflows where an attacker maps management surfaces before attempting credential-based attacks or exploiting further vulnerabilities in the Telnet daemon.

Root Cause

The root cause is missing authorization enforcement in the getTelnetCfg function, classified under [CWE-284] Improper Access Control. Sensitive configuration retrieval routines should require an authenticated session, but the handler processes requests without verifying session tokens or user privileges.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must reach the router's management interface on a local network segment. No authentication, privileges, or user interaction are required. The attacker submits a POST request to /cgi-bin/cstecgi.cgi invoking the getTelnetCfg action and parses the JSON response for the Telnet status field.

No verified public proof-of-concept code has been published. Technical coordination details are referenced in the DarkBoulder CVE Vendor Coordination repository and the ShengWu00 CVE Vendor Coordination repository.

Detection Methods for CVE-2026-51664

Indicators of Compromise

Unauthenticated POST requests to /cgi-bin/cstecgi.cgi containing the getTelnetCfg action parameter
HTTP responses from the router web interface returning Telnet configuration fields to unauthenticated clients
Repeated CGI requests from a single adjacent-network host enumerating configuration handlers

Detection Strategies

Inspect router access logs for POST requests to cstecgi.cgi that lack a valid authenticated session cookie
Correlate reconnaissance patterns where an information disclosure request is followed by Telnet (TCP/23) connection attempts to the same device
Deploy network intrusion detection signatures matching the getTelnetCfg request pattern against cstecgi.cgi

Monitoring Recommendations

Monitor Telnet (TCP/23) connection attempts against IoT and SOHO devices on internal network segments
Track anomalous CGI request volumes to router administrative endpoints from client subnets
Alert on unauthenticated web management interface interactions originating from user VLANs

How to Mitigate CVE-2026-51664

Immediate Actions Required

Disable Telnet on affected TOTOLINK T6 devices and enforce SSH or HTTPS for remote management
Restrict access to the router management interface using ACLs so only trusted administrative hosts can reach /cgi-bin/cstecgi.cgi
Segment IoT and SOHO routers onto isolated VLANs to reduce adjacent-network exposure

Patch Information

No fixed firmware version has been referenced in the NVD entry at publication. Check the TOTOLINK Firmware Download Page and the TOTOLINK Official Website for updated firmware for the T6 model addressing this issue.

Workarounds

Ensure Telnet remains disabled in the device configuration so status disclosure yields no actionable follow-on service
Place the router management interface behind a firewall rule that permits only management VLAN source addresses
Replace end-of-life or unpatched TOTOLINK T6 units with vendor-supported hardware where firmware updates are unavailable

bash

# Example ACL restricting router web management to a dedicated admin subnet
# Applied on the upstream L3 device or router firewall
ip access-list extended RESTRICT_ROUTER_MGMT
  permit tcp 10.10.10.0 0.0.0.255 host 192.168.1.1 eq 80
  permit tcp 10.10.10.0 0.0.0.255 host 192.168.1.1 eq 443
  deny   tcp any host 192.168.1.1 eq 80
  deny   tcp any host 192.168.1.1 eq 443
  deny   tcp any host 192.168.1.1 eq 23
  permit ip any any