Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter wireless… (CVE-2026-51712)

CVE-2026-51712 is an access control vulnerability in the setApWiFiSchCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. It allows unauthenticated remote attackers to alter wireless availability windows by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 3.1 score of 5.9 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation enables unauthenticated attackers to change wireless availability windows on the affected device, potentially disrupting wireless network scheduling or availability. The impact is limited to confidentiality as per the CVSS vector, with no integrity or availability impact reported.

No patch or official remediation has been published for this vulnerability as of the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's management interfaces and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi.