CVE-2026-51693: n/a

This vulnerability arises from improper access control in the setVpnPassCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which allows them to weaken edge filtering controls. The CVSS v3.1 score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to bypass or weaken edge filtering on the affected device, potentially leading to full compromise of confidentiality, integrity, and availability. This could enable attackers to manipulate VPN password configurations or related security controls, severely impacting device security and network protection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.