CVE-2026-51726: n/a

This vulnerability arises from improper access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015. An attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling them to remove parental-control rules without any authentication. The CVSS v3.1 score is 9.1, reflecting a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to remove parental-control rules, potentially bypassing restrictions intended to control network access or content filtering. This compromises the integrity and confidentiality of the parental control configurations on the affected device. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.