CVE-2026-51722: n/a

This vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 arises from improper access control in the setWiFiRepeaterCfg function. An attacker without authentication can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling them to redirect the device's upstream Wi-Fi connection to an attacker-controlled network. This could lead to interception or manipulation of network traffic. The CVSS v3.1 base score is 9.1, reflecting high impact on confidentiality and integrity with no required privileges or user interaction.

Successful exploitation allows an unauthenticated attacker to repoint the device's upstream Wi-Fi to a malicious network, potentially enabling interception or manipulation of network communications. The vulnerability has a high impact on confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.