CVE-2026-51712: n/a

The vulnerability CVE-2026-51712 affects TOTOLINK T6 firmware 4.1.5cu.748_B20211015. It arises from improper access control in the setApWiFiSchCfg function, which can be exploited by unauthenticated attackers sending crafted POST requests to the /cgi-bin/cstecgi.cgi endpoint. This allows attackers to alter wireless availability windows without authentication. The CVSS v3.1 score is 5.9, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No known exploits in the wild or vendor patches have been reported yet.

An unauthenticated attacker can alter the wireless availability schedule on the affected TOTOLINK T6 device, potentially disrupting wireless service availability or bypassing intended wireless access restrictions. The confidentiality impact is high, but integrity and availability are not affected. This could lead to unauthorized changes in wireless access timing, potentially facilitating further attacks or unauthorized network access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network exposure of the affected device, especially limiting access to the /cgi-bin/cstecgi.cgi endpoint from untrusted networks. Monitor for unusual configuration changes and consider network-level controls to prevent unauthorized POST requests to this endpoint.