CVE-2026-51668: n/a

This vulnerability arises from improper access control in the setLanguageCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling modification of the language configuration without any authentication. The CVSS 3.1 base score is 7.5, reflecting high severity due to the ease of remote exploitation without privileges and the impact on integrity. There is no information about available patches or vendor advisories at this time.

The vulnerability allows an unauthenticated attacker to modify the language configuration of the affected device, impacting the integrity of the device's configuration. There is no direct impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.