CVE-2026-51720: n/a

The vulnerability CVE-2026-51720 affects TOTOLINK T6 firmware 4.1.5cu.748_B20211015. Due to improper access control in the delIpPortFilterRules function, an unauthenticated attacker can send a specially crafted POST request to the endpoint /cgi-bin/cstecgi.cgi to remove firewall filter rules. This bypasses normal authentication controls and can compromise firewall protections, resulting in high impact on confidentiality and integrity. The CVSS v3.1 base score is 9.1, reflecting the critical nature of this remote network attack vector with no privileges or user interaction required. No patch or official remediation information is currently available.

Successful exploitation allows an unauthenticated attacker to remove firewall filter rules on the affected device, potentially exposing the network to unauthorized access or attacks. The confidentiality and integrity of the device and network traffic can be severely compromised. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Consider network-level protections to limit exposure of the device to untrusted networks.