CVE-2026-51698: n/a

The vulnerability CVE-2026-51698 affects TOTOLINK T6 version 4.1.5cu.748_B20211015. It arises from improper access control in the setUrlFilterRules function, which can be exploited by unauthenticated attackers to alter browsing policies via a specially crafted POST request to the endpoint /cgi-bin/cstecgi.cgi. The flaw allows attackers to gain unauthorized control over URL filtering rules, potentially compromising network security and user browsing restrictions. The CVSS v3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to modify browsing policies on the affected device, potentially bypassing security controls and altering network filtering rules. This can lead to unauthorized access to restricted content or exposure to malicious sites, impacting confidentiality and integrity of network traffic. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided. Until a patch is available, restrict network access to the management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.