CVE-2026-51656

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control vulnerability in the getVpnPassCfg function. An unauthenticated attacker on an adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to disclose VPN pass-through and WAN ping filter se...