CVE-2026-51679: n/a

This vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 arises from improper access control in the setPasswordCfg function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling them to change the administrator account password. The CVSS v3.1 base score is 9.1, indicating critical severity, with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. No patch or official remediation level has been published yet.

Successful exploitation allows an unauthenticated attacker to change the administrator account password, potentially leading to loss of confidentiality and denial of service due to availability impact. The integrity of the system is not impacted according to the CVSS vector. This could result in unauthorized administrative access and control over the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.