CVE-2026-51733: n/a

This vulnerability involves incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling them to remove Wi-Fi schedule entries without authorization. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently available.

Successful exploitation allows an unauthenticated attacker to remove Wi-Fi schedule entries, potentially disrupting network operations and control. The vulnerability impacts confidentiality, integrity, and availability of the device's Wi-Fi scheduling functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.