External risk intelligence

TOTOLINK T6 Router Configuration Disclosure Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-51669

The vulnerability affects a home router device's web management interface. These devices are frequently deployed as internet-facing gateway appliances, and the targeted endpoint is a web-accessible CGI script commonly used for router configuration.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability identified in TOTOLINK routers, specifically within the `getPairCfg` function. The flaw allows attackers to gain unauthorized access to sensitive network configuration details by sending a specially crafted request. This could potentially expose network pairing and mesh-slave configurations to external parties, posing a significant risk to the integrity and security of the affected networks.

Unauthorized access to network configuration data.
Affects home router devices with internet-facing interfaces.
Confirm relevance and assess exposure risks.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can access a router's web interface, sending a crafted request to a specific CGI script. This allows them to retrieve sensitive pairing and mesh-slave configuration details.

Entry condition: Network access to the device.
Trigger point: Sending a crafted POST request.
Resulting risk: Exposure of sensitive configuration data.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could obtain sensitive pairing and mesh-slave configuration information by sending a specially crafted POST request to a specific CGI script on the device. This could expose details about how the device connects to networks or other devices.

Sensitive network configuration data.
Via crafted POST request to CGI script.
Network and device pairing details exposed.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in TOTOLINK routers, specifically affecting the `getPairCfg` function, allows unauthenticated attackers to gain sensitive configuration details by sending a crafted POST request. Owners of internet-facing network devices and infrastructure teams responsible for securing network perimeters should prioritize identifying and assessing the exposure of these devices, as they may be reachable from the internet and could be used to compromise network configurations.

Identify affected devices and assess exposure.
Confirm device criticality and ownership.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK T6 router?

The TOTOLINK T6 is a networking device often used in home environments to provide Wi-Fi connectivity. It supports mesh networking features, which allow multiple units to work together to extend coverage. This specific vulnerability involves the software managing its configuration and device pairing processes.

What does CWE-284 mean for CVE-2026-51669?

CWE-284 refers to Improper Access Control. In the context of this CVE, it means the router fails to properly verify the identity of a user before granting access to sensitive system functions. Because of this weakness, the device allows unauthorized requests to read internal configuration data that should be restricted.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically formatted POST request to the /cgi-bin/cstecgi.cgi script on the router. It is important to note that simply visiting the router's web interface normally or attempting to log in with incorrect credentials does not trigger this specific issue; the request must be crafted to interact directly with the vulnerable getPairCfg function.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates this risk is 'Likely' because the vulnerability exists within a web management interface on a device typically used as an internet-facing gateway. If your router's management interface is accessible directly from the public internet rather than restricted to your local network, it is at higher risk of being targeted.

What should I do if I use this TOTOLINK model?

Begin by identifying all TOTOLINK T6 units in your environment and determining if their management interfaces are exposed to the internet. If they are, restrict access to these interfaces to trusted internal networks only. Monitor official vendor support channels for any available firmware updates that address this access control issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.