CVE-2026-51693

CriticalCVSS 9.8

Published: 31/08/2026(UTC)Updated: 01/09/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 allows unauthenticated attackers to weaken edge filtering via a crafted POST request to /cgi-bin/cstecgi.cgi.

Risk Assessment

An attacker can weaken network security, potentially enabling unauthorized access or external attacks.

Recommendation

Update TOTOLINK T6 firmware to a version that fixes access control.

Other vulnerabilities in TOTOLINK T6

See all

CVE-2026-51770Unknown
Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51769Unknown
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51768Unknown
Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51767Unknown
Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51766High
Incorrect access control in the setDevReboot function of TOTOLINK T6 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via a crafted MQTT message to the cs_broker component.
CVE-2026-51765Unknown
Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51764Unknown
Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51763Unknown
Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51762Unknown
Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51761Medium
TOTOLINK T6 version 4.1.5cu.748_B20211015 has an incorrect access control vulnerability in the updateLanIp function. Unauthenticated attackers can refresh the LAN address state by sending a crafted MQTT message to the cs_broker component.

Original NVD description (English source)

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi.