CVE-2026-51686
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 allows unauthenticated attackers to reconfigure or disable wireless networks via a crafted POST request to /cgi-bin/cstecgi.cgi.
Risk Assessment
An attacker can change Wi-Fi settings or completely disable the network, leading to loss of connectivity for users.
Recommendation
Update the router firmware and restrict access to the admin panel to prevent unauthorized Wi-Fi configuration changes.
Other vulnerabilities in TOTOLINK T6
See all- CVE-2026-51770Critical
Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51769Critical
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51767Critical
Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51765Critical
Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51764Critical
Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51763Critical
Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51762Critical
Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51760Critical
Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51757Critical
Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51754Critical
Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the cs_broker component.
Original NVD description (English source)
Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.