CVE-2026-51704: n/a

This vulnerability in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 arises from improper access control in the setWiFiMeshConfig function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling unauthorized alteration of mesh network configurations. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low attack complexity and no required privileges or user interaction. There is no indication of confidentiality or availability impact, but integrity of the mesh configuration can be compromised.

An attacker without authentication can alter the mesh network configuration of the affected TOTOLINK T6 device. This could lead to unauthorized changes in network topology or behavior, potentially disrupting network operations or enabling further attacks. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.