CVE-2026-51724: n/a

The vulnerability CVE-2026-51724 affects TOTOLINK T6 firmware 4.1.5cu.748_B20211015. Due to improper access control in the delSmartQosCfg function, an unauthenticated attacker can send a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to remove Smart QoS rules. This flaw allows full control over QoS configurations without authentication, potentially disrupting network traffic management. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to remove Smart QoS rules on affected TOTOLINK T6 devices, potentially disrupting network traffic prioritization and causing denial of service or degradation of network performance. The vulnerability impacts confidentiality, integrity, and availability of the device's QoS configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.