Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger… (CVE-2026-51689)

The vulnerability in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 involves improper access control in the setUpgradeFW function. An attacker without authentication can send a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to manipulate the firmware upgrade process. This could potentially allow unauthorized firmware upgrade workflow changes. No CVSS score or detailed impact metrics are provided, and no official patch or vendor advisory is available at this time.

The vulnerability allows unauthenticated attackers to trigger changes in the firmware upgrade workflow, which could lead to unauthorized firmware modifications. The exact impact is not detailed in the available information, but unauthorized firmware upgrade capabilities typically pose significant security risks including device compromise or persistent control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi to reduce exposure.