CVE-2026-51730
CriticalCVSS 9.1Summary
The delWiFiAclRules function in TOTOLINK T6 4.1.5cu.748_B20211015 has incorrect access control, allowing unauthenticated attackers to remove Wi-Fi ACL rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
Risk Assessment
An attacker can remove Wi-Fi access rules, potentially leading to unauthorized network access.
Recommendation
Update TOTOLINK T6 firmware to the latest version if available. Restrict access to the admin panel and CGI interface.
Other vulnerabilities in TOTOLINK T6
See all- CVE-2026-51740Unknown
Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51739Unknown
Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51738Unknown
Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51737Unknown
Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51736Unknown
Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51735Unknown
Incorrect access control in the showSyslog function of TOTOLINK T6 allows unauthenticated attackers to retrieve recent system logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51734Unknown
Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 allows unauthenticated attackers to trigger mesh slave update coordination by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51733Unknown
Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51732Unknown
Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51731Unknown
Incorrect access control in the delVlanCfg function of TOTOLINK T6 allows unauthenticated attackers to remove VLAN entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Original NVD description (English source)
Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.