CVE-2026-51716: n/a

This vulnerability arises from improper access control in the delPortForwardRules function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which results in deletion of port-forwarding rules. The vulnerability is identified as CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 7.5, indicating high severity. There is no information about available patches or official remediation, and no known exploits in the wild have been reported.

The vulnerability allows unauthenticated attackers to delete port-forwarding rules on affected TOTOLINK T6 devices. This can disrupt network traffic routing and potentially affect network availability or security posture by removing intended port forwarding configurations. There is no indication of confidentiality or availability impact, but integrity of port-forwarding rules is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device management interface to trusted networks only and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. No official remediation or temporary fix has been documented at this time.