CVE-2026-51690: n/a

This vulnerability in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 arises from improper access control in the setWanCfg function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling alteration of upstream provisioning and connectivity settings. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to change critical WAN configuration parameters, potentially disrupting network connectivity or redirecting traffic. The confidentiality and integrity of the device's network settings are severely compromised. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interfaces and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.