CVE-2026-51703: n/a

The vulnerability exists due to incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, enabling them to alter when Wi-Fi is available. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

An unauthenticated attacker can alter the Wi-Fi schedule configuration, potentially disrupting network availability. This could cause denial of service by disabling Wi-Fi at critical times or otherwise interfering with normal Wi-Fi operation. There is no confidentiality impact, but integrity and availability are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor vendor communications for updates and consider restricting network access to the device's management interface until a fix is available.