CVE-2026-51686

CVE-2026-51686 is an incorrect access control flaw (CWE-284) in the setWiFiEasyCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can trigger it by sending a crafted POST request to the router's /cgi-bin/cstecgi.cgi endpoint, requiring no credentials or user interaction and exploitable over the network wherever the management interface is reachable, including from the internet if WAN-side management is enabled. A successful attack lets the attacker reconfigure or completely disable the device's wireless networks, disrupting connectivity for every client that depends on the router. Users and small organizations running a TOTOLINK T6 on the named firmware are affected; other firmware builds or models sharing the same CGI handler are not confirmed in this disclosure and should be verified with the vendor. The flaw is not currently known to be exploited: there is no public proof-of-concept, it is not in CISA KEV, and EPSS assigns it only a 0.4% probability of exploitation in the next 30 days (37th percentile), despite a critical CVSS 3.1 score of 9.8.

What to do: Restrict access to the router's /cgi-bin/cstecgi.cgi management endpoint by disabling WAN-side management or limiting it to trusted LAN clients, and monitor for unauthenticated POST requests invoking setWiFiEasyCfg. Because no fixed version is specified in the disclosure, check TOTOLINK's support/downloads page for updated T6 firmware and ask the vendor whether other firmware versions or models use the same affected handler.