CVE-2026-51700: n/a

This vulnerability arises from improper access control in the setWiFiAdvancedCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which results in degradation of the wireless behavior of the device. The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity but no impact on availability. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to degrade the wireless functionality of the affected TOTOLINK T6 device, potentially impacting confidentiality and integrity of wireless communications. There is no reported impact on availability. The high CVSS score reflects the critical nature of the vulnerability due to ease of exploitation and significant impact on device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.