Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2026-51656: TOTOLINK T6 router reveals VPN and ping settings
CVE-2026-51656 · published 2 months ago
Summary
The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 lets anyone who can reach it view its VPN pass‑through and internet‑connection ping filter settings. Knowing these settings can help a malicious person plan further attacks on your network. Update the router to the latest firmware or follow Totolink’s patch instructions, and disable remote management if it is not required.
Original advisory text
Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings via sending a cr...
Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
4.3
Medium
Type
CWE-284Improper Access Control
Timeline
Published28 Aug 2026
Updated3 Nov 2026
First seen28 Aug 2026
Track software like this
Free during beta