Security readout for executives and security teams
Plain-English summary
A flaw in the TOTOLINK T6 management interface can let a network-accessible attacker view port-forwarding rules without logging in. Those rules may reveal externally exposed services and internal network details. The reported firmware is 4.1.5cu.748_B20211015; broader version exposure is not established by the supplied evidence.
Executive priority
Prioritize identification and containment of affected routers, especially devices with remotely reachable management interfaces or sensitive forwarded services. The critical score warrants prompt action, but evidence of active exploitation and a confirmed vendor fix is absent from the supplied sources.
Technical view
CVE-2026-51661 is an incorrect-access-control issue in getPortForwardRules. A crafted POST request to /cgi-bin/cstecgi.cgi can return port-forwarding rules without authentication. It is rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), although the supplied description demonstrates disclosure rather than explaining the scored high integrity impact.
Likely exposure
Exposure is supported for TOTOLINK T6 firmware 4.1.5cu.748_B20211015 when its management CGI endpoint is reachable over a network. Internet exposure is not stated and should not be assumed. The structured affected-product data is unavailable, so no other models or versions can be confirmed.
Exploitation context
The reported attack requires network access but no authentication or user interaction. The bundle does not establish active exploitation, and the CVE is not identified as being in KEV. Public coordination references exist, but they do not prove exploitation in operational environments.
Researcher notes
Scope is unusually sparse: structured affected fields are listed as unavailable, while the narrative names one model and firmware build. CWE-284 fits the authentication failure. The CVSS vector assigns high confidentiality and integrity impact, but the description only substantiates unauthorized rule disclosure. Patch status and the basis for integrity impact require vendor or CNA clarification.
Mitigation direction
- Inventory TOTOLINK T6 devices and identify installations running firmware 4.1.5cu.748_B20211015.
- Check TOTOLINK guidance for a corrected firmware release or vendor-approved mitigation.
- Until vendor guidance is confirmed, restrict management-interface access to trusted administrative networks.
- Remove unnecessary port-forwarding rules and minimize exposure of services listed by affected devices.
- Isolate or replace affected devices if no supported correction is available.
Validation and detection
- Confirm each device model and firmware using inventory records or its authenticated administrative interface.
- Verify the management CGI interface is unreachable from internet and other untrusted networks.
- Review available logs for unauthenticated requests to /cgi-bin/cstecgi.cgi involving getPortForwardRules.
- Compare installed firmware against current TOTOLINK guidance and document whether a corrected build exists.
- Audit forwarded services for unnecessary or unintended external exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-51661 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.htmlCVE reference, mitre
- https://www.totolink.net/CVE reference, mitre
- https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.mdCVE reference, mitre
- https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.mdCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.