CVE-2026-51686: n/a

This vulnerability arises from improper access control in the setWiFiEasyCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling them to reconfigure or disable wireless network settings without authorization. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently available.

Successful exploitation allows an unauthenticated attacker to fully control wireless network configuration, potentially disabling wireless access or altering network parameters. This compromises network availability and security, leading to denial of service or unauthorized network control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Consider isolating affected devices from untrusted networks to reduce exposure.