CVE-2026-51695: n/a

This vulnerability in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 arises from improper access control in the setDdnsCfg function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which allows alteration of the dynamic DNS configuration state. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No official remediation or patch information is currently available.

The vulnerability allows unauthenticated attackers to modify the dynamic DNS configuration on affected TOTOLINK T6 devices. This impacts the integrity of the device's configuration but does not affect confidentiality or availability. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only to reduce exposure. Monitor for any unusual changes to dynamic DNS settings.