Incorrect Access Control in TOTOLINK T6 4.1.5cu.748_B20211015

Executive Summary

CVE-2026-51666 is an incorrect access control flaw in TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The vulnerability exists in the setWizardCfg function of the cstecgi.cgi component. It allows unauthenticated attackers to modify critical device settings such as WAN configuration, Wi-Fi settings, and device initialization state by sending a specially crafted POST request to /cgi-bin/cstecgi.cgi.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /cgi-bin/cstecgi.cgi with the parameter {"topicurl":"getStaticDhcpRules"}. Check logs for unauthorized access attempts or unusual configuration changes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to take control of your TOTOLINK T6 router without authentication. They could change network settings, disable Wi-Fi, alter firewall rules, or reset the device to factory defaults. This could disrupt internet access, expose your network to further attacks, or allow unauthorized monitoring of your traffic.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to retrieve static DHCP configuration rules, which could expose sensitive network information. Such information disclosure may violate data protection requirements under GDPR or HIPAA if it involves personal or health-related data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the TOTOLINK T6 firmware to the latest version. Restrict access to /cgi-bin/cstecgi.cgi via network firewall rules. Disable unnecessary services and monitor for suspicious POST requests.

Useful 0 Not Useful 0