CVE-2026-51694: n/a

The vulnerability exists due to incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An attacker can exploit this by sending a specially crafted POST request to /cgi-bin/cstecgi.cgi, allowing them to add or change static DHCP rules without authentication. This could lead to unauthorized network configuration changes impacting DHCP behavior. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An unauthenticated attacker can modify static DHCP rules on the affected device, potentially disrupting network operations or redirecting traffic by altering DHCP assignments. This compromises the integrity of the DHCP configuration but does not affect confidentiality or availability according to the CVSS vector.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restricting network access to the device's management interface and monitoring for suspicious POST requests to /cgi-bin/cstecgi.cgi may help reduce risk.