CVE-2026-51722

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 contains an incorrect access-control flaw (CWE-284) in the setWiFiRepeaterCfg function of its web management interface. An unauthenticated attacker who can reach the device's management endpoint can send a crafted POST request to /cgi-bin/cstecgi.cgi that silently rewrites the repeater's upstream Wi-Fi configuration without logging in. By repointing the T6 to an attacker-controlled access point, the attacker inserts themselves into the path of the device's wireless traffic, enabling interception and tampering with data in transit, which is reflected in the CVSS 9.1 score's high confidentiality and integrity impact. Any deployment running the affected firmware is exposed, with risk highest where the management interface is reachable from untrusted LAN segments or from the internet. No public proof-of-concept is known, EPSS currently estimates only about a 0.3% probability of exploitation within 30 days, and the flaw is not in CISA's KEV.

What to do: Check T6 devices for firmware 4.1.5cu.748_B20211015 and apply a newer TOTOLINK firmware release as soon as one addressing this issue is available. Until then, restrict the management interface to trusted LAN segments, disable WAN-side/remote management, and prevent unauthenticated access to /cgi-bin/cstecgi.cgi from untrusted networks. Also review the currently configured repeater upstream SSID/credentials for unauthorized changes.