CVE-2026-51695: n/a

The vulnerability CVE-2026-51695 affects TOTOLINK T6 firmware 4.1.5cu.748_B20211015 and is due to improper access control in the setDdnsCfg function. An attacker without authentication can send a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to alter the dynamic DNS configuration state. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or remediation information is provided, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated attackers to modify the dynamic DNS configuration on affected TOTOLINK T6 devices. This compromises the integrity of the device's DNS settings, potentially redirecting traffic or disrupting intended DNS resolution. There is no direct impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device management interface to trusted users and networks to reduce exposure. Monitor for unusual changes in dynamic DNS settings if possible.