CVE-2026-51695

CVE-2026-51695 is an incorrect access control flaw (CWE-284) in the setDdnsCfg handler of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can trigger it by sending a crafted POST request to the router's /cgi-bin/cstecgi.cgi endpoint, requiring no credentials or user interaction. Successful exploitation lets the attacker modify the router's dynamic DNS configuration state, which can repoint or disrupt the public hostname the router maintains via DDNS and thereby misdirect or break access to services that depend on that name; per the CVSS score (7.5, integrity-only) there is no confidentiality or availability impact. Anyone operating a TOTOLINK T6 on the affected firmware is exposed, with attack reachability from the LAN by default and from the WAN only where the web management interface is exposed or remote management is enabled. As of this writing there is no confirmed in-the-wild exploitation: the flaw is not in CISA KEV, no public PoC is known, and EPSS puts 30-day exploitation probability at about 0.3% (18th percentile).

What to do: Check T6 units for firmware version 4.1.5cu.748_B20211015 and apply TOTOLINK's patched firmware when released (no fixed version is specified in the available data). In the meantime, restrict access to the router's web management interface: disable WAN-side/remote management, limit admin access to trusted LAN segments, and consider blocking unauthenticated POSTs to /cgi-bin/cstecgi.cgi from untrusted networks. Also review the current DDNS configuration on exposed units for unexpected changes, since successful tampering may have repointed a maintained hostname.