CVE-2026-51676: n/a

This vulnerability arises from improper access control in the setAccessDeviceCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling unauthorized alteration of access-device policies. The CVSS 3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to change access-device policies on the affected TOTOLINK T6 device, potentially compromising device security and network access controls. The vulnerability does not impact availability. The high CVSS score reflects the critical nature of unauthorized access and modification.

No patch or official remediation has been provided or referenced in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device management interface and monitor for suspicious POST requests targeting /cgi-bin/cstecgi.cgi.