CVE-2026-51681
CriticalCVSS 9.1Summary
Incorrect access control in the setRemoteCfg function of TOTOLINK T6 allows unauthenticated attackers to expose WAN-side administration via a crafted POST request to /cgi-bin/cstecgi.cgi.
Risk Assessment
An attacker can remotely access the router's admin panel, potentially leading to full device compromise.
Recommendation
Update the router firmware and disable remote access to the admin panel if not required.
Other vulnerabilities in TOTOLINK T6
See all- CVE-2026-51740Unknown
Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51739Unknown
Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51738Unknown
Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51737Unknown
Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51736Unknown
Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51735Unknown
Incorrect access control in the showSyslog function of TOTOLINK T6 allows unauthenticated attackers to retrieve recent system logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51734Unknown
Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 allows unauthenticated attackers to trigger mesh slave update coordination by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51733Unknown
Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51732Unknown
Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51731Unknown
Incorrect access control in the delVlanCfg function of TOTOLINK T6 allows unauthenticated attackers to remove VLAN entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Original NVD description (English source)
Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.