CVE-2026-51729

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 contains an incorrect access control issue (CWE-284) in the delDevice function of its web management CGI. An unauthenticated attacker can trigger the flaw by sending a crafted POST request to /cgi-bin/cstecgi.cgi, without needing credentials or user interaction. Successful exploitation lets the attacker request deletion of a managed slave device, i.e., a mesh satellite unit managed by the T6, which can remove extension nodes from the wireless network and disrupt the mesh; the flaw carries a critical CVSS 3.1 score of 9.1. Anyone running the affected T6 firmware is exposed, particularly units whose management interface is reachable from the WAN. No public proof-of-concept is known, the CVE is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.3%, so exploitation is not currently observed.

What to do: Check whether your T6 runs firmware 4.1.5cu.748_B20211015 and apply a patched firmware from TOTOLINK when one is released (no fixed version is specified in the available data). Until then, restrict exposure of the router's management interface — do not forward or expose /cgi-bin/cstecgi.cgi to the WAN — and monitor for unauthenticated POST requests targeting that endpoint.