CVE-2026-51667: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51667 Overview

CVE-2026-51667 is an improper access control vulnerability [CWE-284] affecting the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. The flaw resides in the getWiFiIpMacTable function exposed through the /cgi-bin/cstecgi.cgi endpoint. An unauthenticated attacker on an adjacent network can send a crafted HTTP POST request to retrieve Wi-Fi client MAC-to-IP address mappings. The disclosed information supports reconnaissance activities such as device fingerprinting, targeted client attacks, and lateral movement planning within the wireless network segment.

Critical Impact
Unauthenticated attackers within radio range can enumerate all Wi-Fi clients connected to a vulnerable TOTOLINK T6 router without credentials or user interaction.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
getWiFiIpMacTable handler within /cgi-bin/cstecgi.cgi

Discovery Timeline

2026-08-31 - CVE-2026-51667 published to the National Vulnerability Database
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51667

Vulnerability Analysis

The TOTOLINK T6 exposes a Common Gateway Interface (CGI) binary at /cgi-bin/cstecgi.cgi that dispatches requests to internal handler functions based on POST body parameters. The getWiFiIpMacTable handler returns a table mapping wireless client Media Access Control (MAC) addresses to their assigned IP addresses. This handler does not verify whether the requester holds an authenticated administrative session before returning the data.

The returned data exposes the internal wireless topology of the network. Attackers gain visibility into device counts, vendor identifiers derived from MAC prefixes, and DHCP address allocations. This information supports downstream attacks including ARP spoofing, targeted deauthentication, and client impersonation.

Root Cause

The root cause is a missing authorization check on a sensitive information-disclosure endpoint. The CGI dispatcher routes requests to getWiFiIpMacTable without validating the session cookie or authentication token that other administrative functions require. This aligns with the CWE-284 classification for improper access control.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must reach the router's LAN or wireless interface directly. The attacker sends a single crafted POST request to /cgi-bin/cstecgi.cgi with a body invoking the getWiFiIpMacTable action. The server responds with the MAC-to-IP mapping table in structured format. No credentials, user interaction, or prior compromise is required. See the DarkBoulder CVE coordination repository and the ShengWu00 CVE coordination repository for coordination details.

Detection Methods for CVE-2026-51667

Indicators of Compromise

Unexpected HTTP POST requests to /cgi-bin/cstecgi.cgi referencing the getWiFiIpMacTable topic or action parameter
Requests to the CGI endpoint from client IP addresses that do not correspond to authenticated administrator sessions
Repeated polling of the CGI endpoint over short intervals from a single source

Detection Strategies

Enable HTTP access logging on the router management interface and forward logs to a central collector for inspection
Configure intrusion detection signatures that flag POST requests containing the getWiFiIpMacTable string on ports serving the TOTOLINK web interface
Baseline normal management traffic to the router and alert on out-of-hours or unauthenticated access to CGI handlers

Monitoring Recommendations

Monitor wireless LAN segments for unauthorized devices probing the router administration interface
Correlate router CGI requests with DHCP lease events to identify reconnaissance patterns preceding client-targeted attacks
Track deauthentication frames and ARP anomalies that may follow successful enumeration of Wi-Fi clients

How to Mitigate CVE-2026-51667

Immediate Actions Required

Restrict management interface access to trusted wired VLANs and block administrative CGI endpoints from wireless clients
Disable remote management on WAN interfaces if enabled
Audit connected Wi-Fi client inventories and rotate pre-shared keys if unauthorized access is suspected

Patch Information

No vendor patch is referenced in the CVE record at the time of publication. Consult the TOTOLINK official website and the TOTOLINK download portal for firmware updates addressing the getWiFiIpMacTable access control issue on the T6 platform.

Workarounds

Place the TOTOLINK T6 behind a firewall that filters inbound requests to /cgi-bin/cstecgi.cgi from untrusted subnets
Segment guest and IoT wireless networks onto separate SSIDs and VLANs to limit adjacent-network attack surface
Replace end-of-life or unmaintained firmware with a supported build once the vendor releases a fix

bash

# Example iptables rule to restrict CGI endpoint to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP