CVE-2026-51717: n/a

The vulnerability CVE-2026-51717 affects TOTOLINK T6 firmware 4.1.5cu.748_B20211015. Due to improper access control in the setOpModeCfg function, an unauthenticated attacker can send a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to change the device's operating mode. This flaw allows unauthorized modification of device configuration, potentially compromising device behavior and security. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to change the operating mode of the TOTOLINK T6 device, potentially leading to unauthorized control or disruption of device functionality. The vulnerability impacts confidentiality and integrity but does not affect availability. This can result in significant security risks depending on the device's deployment context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.