CVE-2026-51711: n/a

This vulnerability arises from improper access control in the setWiFiWpsStart function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, triggering the opening of a wireless pairing window. The weakness is classified under CWE-284 (Improper Access Control). The CVSS v3.1 base score is 9.1, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to open a wireless pairing window, potentially enabling unauthorized access to the device's wireless network. This compromises confidentiality and integrity of the device and network communications. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor the vendor's communications for updates. Until a patch is available, restricting network access to the device management interface and disabling WPS if possible may reduce exposure.