Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the… (CVE-2026-51679)

The TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015 contains an access control vulnerability in the setPasswordCfg function. Due to improper access restrictions, unauthenticated attackers can send specially crafted POST requests to the /cgi-bin/cstecgi.cgi CGI endpoint to change the administrator account password. This vulnerability could allow attackers to gain administrative control over the device without authentication.

Successful exploitation allows an unauthenticated attacker to change the administrator account password, potentially leading to full administrative control of the affected device. This compromises device security and could enable further malicious activities such as configuration changes or network compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi.