CVE-2026-51680: n/a

This vulnerability arises from improper access control in the setLedCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An attacker without authentication can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling modification of the LED behavior on the device. The CVSS v3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). There is no known exploit in the wild and no vendor-provided patch or remediation information at this time.

Successful exploitation allows unauthenticated attackers to modify LED behavior on the affected device, impacting confidentiality and integrity of device settings. There is no reported impact on availability. The high CVSS score indicates a critical security risk due to the lack of authentication and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device's management interface to trusted users only and monitor for unusual POST requests targeting /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.