CVE-2026-51666: n/a

This vulnerability arises from improper access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015. An unauthenticated attacker can send a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to modify WAN, Wi-Fi, and device initialization settings. The CVSS 3.1 base score is 4.3 (medium), reflecting low complexity and no privileges required, but limited impact confined to integrity without affecting confidentiality or availability. There is no known exploit in the wild and no vendor advisory or patch information available at this time.

An unauthenticated attacker can alter network configuration settings such as WAN and Wi-Fi parameters and device initialization state. This could lead to unauthorized changes in device behavior or network connectivity. However, the vulnerability does not allow disclosure of information or denial of service. The impact is limited to integrity modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. No official fix or temporary workaround is currently documented.