CVE-2026-51730: n/a

The vulnerability CVE-2026-51730 affects TOTOLINK T6 firmware 4.1.5cu.748_B20211015. It is caused by improper access control in the delWiFiAclRules function, which can be exploited by unauthenticated attackers via a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. This allows attackers to remove Wi-Fi ACL rules, potentially enabling unauthorized devices to connect to the network. The CVSS v3.1 score is 9.1, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to remove Wi-Fi ACL rules on the affected device, compromising the integrity and confidentiality of the Wi-Fi network by potentially allowing unauthorized access. There is no indication of impact on availability. This could lead to unauthorized network access and potential further compromise of network resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or vendor advisory is currently available. Until a patch is released, restrict network exposure of the device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Consider disabling remote management if enabled.