CVE-2026-51694: n/a

The vulnerability CVE-2026-51694 affects TOTOLINK T6 firmware 4.1.5cu.748_B20211015. Due to improper access control in the setStaticDhcpRules function, unauthenticated remote attackers can send specially crafted POST requests to the /cgi-bin/cstecgi.cgi endpoint to add or alter static DHCP rules. This can compromise the integrity of DHCP configurations. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to modify static DHCP rules on the affected device, potentially disrupting network configurations or enabling further attacks that rely on DHCP manipulation. The integrity of DHCP settings can be compromised, but confidentiality and availability are not directly impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device's management interface to trusted users only and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.