CVE-2026-51734
UnknownSummary
Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 allows unauthenticated attackers to trigger mesh slave update coordination by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Risk Assessment
An attacker can disrupt mesh network operations or force unwanted updates, potentially leading to service outages or integrity compromise.
Recommendation
Update the router firmware to the latest version if available, and restrict access to the administrative interface to trusted networks only.
Other vulnerabilities in TOTOLINK T6
See all- CVE-2026-51740Unknown
Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51739Unknown
Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51738Unknown
Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51737Unknown
Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51736Unknown
Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51735Unknown
Incorrect access control in the showSyslog function of TOTOLINK T6 allows unauthenticated attackers to retrieve recent system logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51733Unknown
Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51732Unknown
Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51731Unknown
Incorrect access control in the delVlanCfg function of TOTOLINK T6 allows unauthenticated attackers to remove VLAN entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51729Unknown
Incorrect access control in the delDevice function of TOTOLINK T6 allows unauthenticated attackers to request deletion of a managed slave device by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Original NVD description (English source)
Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi.