CVE-2026-51724
UnknownSummary
In TOTOLINK T6 router version 4.1.5cu.748_B20211015, incorrect access control in the delSmartQosCfg function allows unauthenticated attackers to remove Smart QoS rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Risk Assessment
An unauthenticated attacker can remotely remove QoS rules, potentially leading to degradation of network service quality or disruption of network operations.
Recommendation
Update the router firmware to the latest version if a patch is available, and restrict access to the administrative panel.
Other vulnerabilities in TOTOLINK T6
See all- CVE-2026-51770Unknown
Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51769Unknown
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51768Unknown
Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51767Unknown
Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51766High
Incorrect access control in the setDevReboot function of TOTOLINK T6 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via a crafted MQTT message to the cs_broker component.
- CVE-2026-51765Unknown
Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51764Unknown
Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51763Unknown
Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51762Unknown
Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51761Medium
TOTOLINK T6 version 4.1.5cu.748_B20211015 has an incorrect access control vulnerability in the updateLanIp function. Unauthenticated attackers can refresh the LAN address state by sending a crafted MQTT message to the cs_broker component.
Original NVD description (English source)
Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Smart QoS rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.