CVE-2026-51689
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Incorrect access control in the setUpgradeFW function of TOTOLINK T6 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via a crafted POST request to /cgi-bin/cstecgi.cgi.
Risk Assessment
An attacker can initiate unauthorized firmware updates, potentially leading to malware installation or router damage.
Recommendation
Update the router firmware to the latest version and disable remote access to upgrade functions if possible.
Other vulnerabilities in TOTOLINK T6
See all- CVE-2026-51764Unknown
Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51762Unknown
Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51760Unknown
Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51757Unknown
Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51754Unknown
Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51751Unknown
Incorrect access control in the delSlaveDevice function of TOTOLINK T6 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via a crafted MQTT message to the cs_broker component.
- CVE-2026-51750Unknown
Incorrect access control in the updatePriChannel function of TOTOLINK T6 allows unauthenticated attackers to rescan and switch the primary mesh channel via a crafted MQTT message to the cs_broker component.
- CVE-2026-51747Unknown
Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51744Unknown
Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51741Unknown
Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Original NVD description (English source)
Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi.