CVE-2026-51679

TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 contains an improper access control flaw (CWE-284) in the setPasswordCfg function of its web management CGI. An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to change the administrator account's credentials. Successful exploitation grants full administrative control of the router, letting the attacker alter its configuration, redirect traffic, or establish persistence. All TOTOLINK T6 units running the affected firmware are impacted, particularly those with the management interface reachable from the internet; the flaw is rated critical (CVSS 9.1). No public proof-of-concept or in-the-wild exploitation is currently known, and the EPSS score of 0.3% (28th percentile) suggests low near-term exploitation likelihood.

What to do: Check your T6 firmware version and update to the latest release from TOTOLINK when available (no fixed version is identified in the available data). Until patched, do not expose the router's web management interface to the internet; restrict it to the LAN or require VPN access. On affected devices, verify the administrator credentials have not been unexpectedly changed.