CVE-2026-51680
CriticalCVSS 9.1Summary
Incorrect access control in the setLedCfg function of TOTOLINK T6 allows unauthenticated attackers to modify LED behavior via a crafted POST request to /cgi-bin/cstecgi.cgi.
Risk Assessment
An attacker can change LED indications, potentially hindering network troubleshooting or hiding unauthorized activity.
Recommendation
Update the router firmware and restrict access to the admin panel to prevent unauthorized LED configuration changes.
Other vulnerabilities in TOTOLINK T6
See all- CVE-2026-51740Unknown
Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51739Unknown
Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51738Unknown
Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51737Unknown
Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51736Unknown
Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51735Unknown
Incorrect access control in the showSyslog function of TOTOLINK T6 allows unauthenticated attackers to retrieve recent system logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51734Unknown
Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 allows unauthenticated attackers to trigger mesh slave update coordination by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51733Unknown
Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51732Unknown
Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51731Unknown
Incorrect access control in the delVlanCfg function of TOTOLINK T6 allows unauthenticated attackers to remove VLAN entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Original NVD description (English source)
Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.