CVE-2026-51714: n/a

This vulnerability involves incorrect access control in the setRoamingCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can send a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to alter the device's roaming configuration. The CVSS vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An attacker without authentication can change the roaming behavior settings of the affected TOTOLINK T6 device. This could lead to unauthorized configuration changes that may affect network connectivity or device behavior. Confidentiality impact is rated high, but integrity and availability are not impacted according to the CVSS vector. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restricting network access to the device's management interface and disabling remote management if possible may reduce exposure.