CVE-2026-51692: n/a

This vulnerability arises from improper access control in the setWiFiGuestCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An attacker without authentication can send a crafted POST request to the endpoint /cgi-bin/cstecgi.cgi to alter guest Wi-Fi configuration, potentially enabling unauthorized access or reducing security controls on the guest wireless network. The CVSS v3.1 base score is 9.1, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to establish or weaken guest wireless access controls, potentially granting unauthorized network access or reducing the security posture of the guest Wi-Fi network. This impacts confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network exposure of the affected device and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.