CVE-2026-51687: n/a

This vulnerability arises from improper access control in the setWiFiEasyGuestCf function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling them to create or weaken the guest wireless access settings. The CVSS 3.1 score of 9.1 reflects the critical impact with network attack vector, no privileges required, no user interaction, and high confidentiality and integrity impact. There is no official patch or remediation level provided, and no known exploits are reported in the wild as of the published date.

Successful exploitation allows an unauthenticated attacker to modify guest wireless access configurations, potentially creating or weakening guest network access controls. This results in a high impact on confidentiality and integrity of the device's wireless guest network settings. Availability is not affected. The vulnerability could enable unauthorized network access or manipulation of guest wireless parameters.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interfaces and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi. Consider disabling guest wireless access if not needed to reduce exposure.