CVE-2026-51736: n/a

The vulnerability CVE-2026-51736 affects TOTOLINK T6 firmware 4.1.5cu.748_B20211015. It is caused by improper access control in the clearSyslog function, which can be exploited by unauthenticated attackers to delete system logs via a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. The vulnerability is categorized under CWE-284 (Improper Access Control). There is no vendor advisory or patch information available at this time.

Successful exploitation allows unauthenticated attackers to erase system logs, potentially covering their tracks and hindering forensic investigations. The vulnerability impacts confidentiality and integrity but does not affect availability. This could facilitate further attacks or unauthorized activities without detection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the affected device and monitoring for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.