CVE-2026-51729: n/a

This vulnerability arises from improper access control in the delDevice function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, triggering deletion of managed slave devices. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction needed, and high impact on confidentiality and integrity. No patch or remediation information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to delete managed slave devices on the affected TOTOLINK T6 device, resulting in high confidentiality and integrity impact. This could disrupt device management and potentially affect network operations relying on these slave devices. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interface to trusted users only and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.