Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side… (CVE-2026-51681)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the setRemoteCfg function. An attacker without authentication can send a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which exposes WAN-side administrative functionality. This could potentially allow unauthorized access to router administration interfaces over the WAN. There is no information on available patches or vendor advisories at this time.

This vulnerability enables unauthenticated attackers to access WAN-side administration interfaces, potentially allowing unauthorized control or configuration of the affected device. The exact impact depends on the administrative capabilities exposed but generally represents a significant security risk for affected devices exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restricting WAN-side access to the device and disabling remote administration features where possible may reduce exposure.