Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure or… (CVE-2026-51686)

The vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 arises from improper access control in the setWiFiEasyCfg function. Unauthenticated attackers can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, enabling them to modify wireless network settings or disable the wireless functionality entirely. No CVSS score or detailed impact metrics are provided, and no patch or remediation information is available from the source data.

Successful exploitation allows an unauthenticated attacker to reconfigure or disable the wireless network on affected TOTOLINK T6 devices. This could lead to denial of wireless service or unauthorized changes to network configuration, potentially disrupting network availability or security controls dependent on wireless connectivity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device management interface and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi. Avoid exposing the device management interface to untrusted networks.