CVE-2026-51709: n/a

The vulnerability CVE-2026-51709 affects TOTOLINK T6 firmware 4.1.5cu.748_B20211015. Due to improper access control in the setWiFiBasicCfg function, unauthenticated attackers can send specially crafted POST requests to the /cgi-bin/cstecgi.cgi endpoint to modify the primary Wi-Fi configuration. This flaw allows full control over Wi-Fi settings without authentication, posing a critical security risk. The CVSS v3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently available.

Successful exploitation allows unauthenticated attackers to fully reconfigure the primary Wi-Fi settings of the affected device. This can lead to complete compromise of wireless network security, potentially enabling interception, disruption, or redirection of network traffic. The vulnerability impacts confidentiality, integrity, and availability of the device and connected network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Consider isolating affected devices from untrusted networks to reduce exposure.