Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create or… (CVE-2026-51687)

The TOTOLINK T6 device running firmware 4.1.5cu.748_B20211015 contains an access control vulnerability in the setWiFiEasyGuestCf function. An attacker without authentication can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint, enabling them to create or weaken guest wireless access configurations. This could potentially allow unauthorized network access through the guest Wi-Fi interface.

Unauthenticated attackers can modify guest wireless access settings, potentially creating or weakening guest Wi-Fi access controls. This may lead to unauthorized access to the network's guest segment, increasing the risk of network misuse or further attacks originating from the guest network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's management interface from untrusted networks and monitor for suspicious POST requests to /cgi-bin/cstecgi.cgi.