CVE-2026-51631 in TOTOLINK
Summary
by MITRE • 08/28/2026
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015 represents a critical failure in access control mechanisms within the device's web management interface. Specifically, the flaw resides in the getStaticDhcpRules function, which is exposed through the Common Gateway Interface script located at /cgi-bin/cstecgi.cgi. This architectural design allows unauthenticated actors to interact with sensitive administrative functions without requiring valid credentials or session tokens. The core technical issue stems from a lack of proper authentication checks before processing requests directed at this specific endpoint, enabling remote attackers to retrieve internal network configuration details that should be restricted to authorized administrators only.
From an operational perspective, the ability to obtain Wi-Fi Protected Setup runtime status via a crafted POST request provides adversaries with valuable intelligence regarding the wireless security posture of the target device. WPS is often used for simplified connection processes but has historically been associated with significant security risks due to its susceptibility to brute-force attacks against PIN codes. By accessing the runtime status, an attacker can determine if WPS is enabled and potentially gather information about connected devices or network configuration parameters that facilitate further exploitation. This exposure effectively lowers the barrier for entry into a home or small office network, as it allows external parties to map out potential attack vectors without needing to bypass traditional authentication layers first.
This vulnerability aligns with CWE-284 Improper Access Control and falls under the MITRE ATT&CK framework category of Discovery, specifically relating to Network Service Scanning and potentially Credential Dumping if combined with other exploits. The lack of authorization checks on a CGI endpoint is a common pattern in embedded devices where developers may prioritize functionality over security during rapid deployment cycles. Such oversights allow attackers to enumerate system capabilities and gather data that can be leveraged for more severe attacks, including unauthorized network access or denial-of-service conditions by manipulating DHCP settings if further write-access vulnerabilities exist.
Mitigation strategies must focus on immediate remediation of the authentication gap. Users should update their router firmware to a version where this specific access control flaw has been patched by TOTOLINK. In environments where updating is not immediately feasible, network segmentation can help isolate vulnerable devices from critical internal resources. Additionally, disabling WPS entirely if it is not required reduces the attack surface associated with wireless configuration exposure. Security administrators should also implement strict firewall rules to restrict access to management interfaces like /cgi-bin/cstecgi.cgi to trusted IP addresses only, thereby preventing unauthenticated remote exploitation attempts over the internet or untrusted networks.