Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate the… (CVE-2026-51691)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 involves improper access control in the setUploadSetting function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, enabling manipulation of the device's upload or firmware flash process. This could potentially allow unauthorized modification of device settings or firmware. There is no CVSS score or detailed vendor advisory available, and no affected versions beyond the stated firmware version are explicitly identified.

Unauthenticated attackers can manipulate the upload or flash workflow of the TOTOLINK T6 device, potentially leading to unauthorized firmware modification or configuration changes. This could compromise device integrity and security. No known exploits in the wild have been reported, and the exact impact depends on the attacker's ability to successfully manipulate the upload process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.