CVE-2026-51738: n/a

This vulnerability arises from improper access control in the LoadDefSettings function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. An attacker without authentication can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which triggers a reset of the device configuration and causes the device to reboot. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.

Successful exploitation allows a remote unauthenticated attacker to reset the device configuration and reboot the device, resulting in complete loss of device availability and potential compromise of device settings. This can disrupt network operations and may require manual reconfiguration of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device management interface to trusted users only and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Consider isolating the device from untrusted networks to reduce exposure.