CVE-2026-51680

CVE-2026-51680 is an incorrect access-control flaw (CWE-284) in the setLedCfg function of the TOTOLINK T6 router's web management CGI, present in firmware version 4.1.5cu.748_B20211015. An unauthenticated attacker can trigger it by sending a crafted POST request to /cgi-bin/cstecgi.cgi, with no login, privileges, or user interaction required. The attacker gains the ability to modify the device's LED behavior/configuration; the described impact is limited to LED settings, although the CVSS 3.1 score of 9.1 weights confidentiality and integrity heavily. Only TOTOLINK T6 routers running the named firmware, typically consumer/SOHO deployments whose admin interface is reachable from untrusted or internet-facing networks, are affected. There is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns only a 0.3% probability of exploitation in the next 30 days, so no exploitation is currently known.

What to do: No fixed firmware version is listed in the available data, so check the TOTOLINK support/download site for T6 firmware newer than 4.1.5cu.748_B20211015 and apply it when released. In the meantime, disable WAN-side/remote web management or restrict access to the router's admin interface and /cgi-bin/cstecgi.cgi to trusted networks only. Verify the running firmware version in the admin UI to confirm exposure; impact is limited to LED configuration changes.