CVE-2026-51665 Overview
CVE-2026-51665 is an incorrect access control vulnerability in the getTracerouteCfg function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers on an adjacent network can retrieve traceroute diagnostic logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The flaw maps to [CWE-284: Improper Access Control] and requires no authentication or user interaction. Exploitation exposes internal network topology data that supports reconnaissance for follow-on attacks.
Critical Impact
Adjacent-network attackers can extract traceroute diagnostic logs from affected TOTOLINK T6 devices without authentication, revealing internal routing and topology information.
Affected Products
- TOTOLINK T6 router
- Firmware version 4.1.5cu.748_B20211015
- The getTracerouteCfg handler in /cgi-bin/cstecgi.cgi
Discovery Timeline
- 2026-08-28 - CVE-2026-51665 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-51665
Vulnerability Analysis
The TOTOLINK T6 web management interface exposes a Common Gateway Interface (CGI) endpoint at /cgi-bin/cstecgi.cgi that dispatches requests to internal handlers based on JSON parameters. The getTracerouteCfg handler is intended to return traceroute diagnostic output to authenticated administrators. On the affected firmware build, the handler does not verify the session state or authorization of the caller before returning data.
An attacker on the same wireless or wired broadcast domain can issue a POST request that invokes getTracerouteCfg and receive the stored traceroute logs. These logs typically contain internal IP addresses, hop counts, and gateway information that describe the network layout behind the router. The disclosure supports lateral movement planning and identification of additional targets.
Root Cause
The root cause is a missing authorization check in the getTracerouteCfg request handler. The CGI dispatcher accepts the function invocation and returns diagnostic data without validating that the request originates from an authenticated administrative session. This is a classic [CWE-284] access control failure where a sensitive read operation is exposed to unauthenticated callers.
Attack Vector
The attack requires network adjacency, meaning the attacker must reach the router's LAN or Wi-Fi interface. No credentials, tokens, or user interaction are required. An attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi referencing the getTracerouteCfg function and parses the JSON response containing the traceroute log data. Refer to the coordinated disclosure repositories in the DarkBoulder TOTOLINK coordination README and the ShengWu00 TOTOLINK coordination README for further technical context.
Detection Methods for CVE-2026-51665
Indicators of Compromise
- Unauthenticated POST requests to /cgi-bin/cstecgi.cgi referencing the getTracerouteCfg function.
- HTTP responses from the router containing traceroute output sent to LAN clients that have not completed an administrative login.
- Repeated requests to the CGI endpoint from unexpected internal hosts or guest Wi-Fi clients.
Detection Strategies
- Inspect router HTTP access logs, where available, for requests to cstecgi.cgi that reference the traceroute configuration function without a preceding authenticated session.
- Use network sensors on the LAN or wireless segment to identify plaintext HTTP calls to the router management interface from non-administrative endpoints.
- Correlate management-plane requests with authentication events to flag calls made outside of active admin sessions.
Monitoring Recommendations
- Restrict and monitor Layer 2 access to the router's management interface, especially on guest and IoT subnets.
- Alert on any client device that issues repeated POST requests to /cgi-bin/cstecgi.cgi.
- Track outbound reconnaissance activity from hosts that have recently interacted with the router management endpoint.
How to Mitigate CVE-2026-51665
Immediate Actions Required
- Isolate TOTOLINK T6 devices running firmware 4.1.5cu.748_B20211015 from untrusted LAN and Wi-Fi segments.
- Disable remote and LAN-side access to the web management interface for non-administrative clients using access control lists or VLAN segmentation.
- Rotate any Wi-Fi pre-shared keys and administrative credentials if unauthorized devices may have connected to the network.
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Check the TOTOLINK official website and the TOTOLINK download page for firmware updates that address the getTracerouteCfg access control issue.
Workarounds
- Place the router management interface on a dedicated administrative VLAN reachable only from trusted hosts.
- Disable the guest network or apply client isolation so untrusted clients cannot reach the router's HTTP interface.
- Replace end-of-support consumer routers with models that receive current firmware maintenance if no fix becomes available.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.