CVE-2026-51705

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw (CWE-284) in the setWiFiMeshName function of the device's web management interface. An unauthenticated attacker who can reach the router's management interface can send a crafted POST request to /cgi-bin/cstecgi.cgi and rename mesh entries without providing any credentials. Because the affected endpoint performs no authentication, any untrusted client with network access to the CGI handler can alter this configuration; the vendor-assigned CVSS 3.1 score of 9.8 (critical) assumes high confidentiality, integrity, and availability impact, though the published description specifically documents the ability to rename mesh entries. All T6 units running the listed firmware are affected, with risk concentrated on routers whose management interface is reachable from the WAN or an untrusted network. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates a 0.4% probability of exploitation within 30 days.

What to do: Inventory TOTOLINK T6 devices and check the running firmware version; units on 4.1.5cu.748_B20211015 should be treated as affected. Until a vendor patch is published (no fixed version is specified in the available data), restrict the web management interface by disabling WAN-side/remote management and limiting access to trusted sources, and monitor TOTOLINK's support site for a fixed firmware release.