CVE-2026-51691

CVE-2026-51691 is an improper access control flaw (CWE-284) in the setUploadSetting function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can trigger it by sending a crafted POST request to the router's management endpoint /cgi-bin/cstecgi.cgi, reaching setUploadSetting without any credentials. By manipulating the upload or flash workflow, the attacker can invoke or alter upload/flash operations on the device, and the critical 9.8 CVSS 3.1 score indicates potentially high impact to confidentiality, integrity, and availability (e.g., unwanted firmware/upload actions or device disruption). Any administrator of a TOTOLINK T6 router on the affected firmware is exposed, especially units whose web management interface is reachable from untrusted networks. There is currently no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.4%, so no exploitation is confirmed.

What to do: Check TOTOLINK's support site for a T6 firmware release newer than 4.1.5cu.748_B20211015 and upgrade when available, since no fixed version is specified in the available data. In the interim, restrict access to /cgi-bin/cstecgi.cgi to trusted management networks (e.g., disable WAN-side remote management and firewall the admin interface), and watch for unexpected upload or flash activity in device logs.