CVE-2026-51696: n/a

This vulnerability arises from improper access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015. An attacker without authentication can send a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to manipulate port forwarding rules, potentially exposing internal network services to unauthorized external access. This flaw corresponds to CWE-284 (Improper Access Control) and has a critical CVSS 3.1 base score of 9.8, reflecting its ease of exploitation and severe impact on system confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to modify port forwarding rules, exposing internal services to the internet. This can lead to unauthorized access, data compromise, and disruption of network services. The vulnerability affects the confidentiality, integrity, and availability of the affected device and its internal network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.