CVE-2026-51728

CVE-2026-51728 is an incorrect access-control flaw (CWE-284) in the UploadFirmwareFile function of TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can trigger it by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, uploading a crafted firmware image without any credentials. Because the firmware-upload function performs no access control, a remote attacker who can reach the device's management interface can push modified firmware and gain full control of the router, driving the critical 9.8 CVSS score (high confidentiality, integrity, and availability impact). The flaw was confirmed in T6 firmware 4.1.5cu.748_B20211015; the available data does not confirm whether other TOTOLINK models or firmware builds are also affected. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and EPSS estimates only a ~0.3% probability of exploitation in the next 30 days.

What to do: Check TOTOLINK T6 units for firmware version 4.1.5cu.748_B20211015 and apply a firmware update from TOTOLINK's support site when a fixed build is published. Until then, do not expose the router's management interface (and /cgi-bin/cstecgi.cgi) to the internet: disable WAN-side remote management and restrict access to the LAN or a management VLAN. No patch version is confirmed in the available data, so monitor the vendor's advisory for fixed firmware.