Incorrect Access Control in TOTOLINK T6 Router

Executive Summary

CVE-2026-51720 is an incorrect access control vulnerability in the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to manipulate firewall filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The function delIpPortFilterRules is affected, enabling unauthorized removal of security rules.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /cgi-bin/cstecgi.cgi with parameters like {"topicurl":"getStaticDhcpRules"}. Check firewall logs for unauthorized modifications to filter rules. Use packet inspection tools such as Wireshark to analyze HTTP POST requests targeting the vulnerable endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to bypass authentication and remove firewall rules remotely. This could disable network security protections, expose internal systems to attacks, or disrupt network operations. Attackers may gain control over network traffic filtering and expose sensitive network configurations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the TOTOLINK T6 router firmware to the latest version. Disable remote administration features if not required. Restrict access to the router's web interface via firewall rules. Monitor network traffic for suspicious POST requests to /cgi-bin/cstecgi.cgi.

Useful 0 Not Useful 0