CVE-2026-51713: n/a

This vulnerability arises from improper access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling manipulation of the WAN dial state. The CVSS v3.1 score is 9.1, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows an unauthenticated attacker to manipulate WAN dial state, potentially disrupting network connectivity or redirecting traffic. The vulnerability compromises confidentiality and integrity of the WAN configuration, which could lead to further network attacks or interception of data. There is no known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, restrict access to the device management interface from untrusted networks and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi.