CVE-2026-51740

CVE-2026-51740 is an incorrect access control flaw (CWE-284) in the killProcess function of TOTOLINK T6 router firmware, with the affected build identified as 4.1.5cu.748_B20211015. An unauthenticated attacker can trigger it by sending a crafted POST request to the router's /cgi-bin/cstecgi.cgi endpoint, invoking killProcess without any authentication or authorization checks. Successful exploitation allows the attacker to terminate critical services running on the device, resulting in a denial-of-service condition on the router (CVSS 3.1: 9.8, network vector with high availability impact). Only TOTOLINK T6 devices running the affected firmware are known to be impacted, with home and small-office users of this budget router model constituting the population at risk. No public proof-of-concept exists, the flaw is not in CISA KEV, and EPSS assigns roughly a 0.4% probability of exploitation within 30 days, so no in-the-wild exploitation is currently known.

What to do: Update T6 firmware to the latest build published by TOTOLINK, since the advisory does not specify a fixed version. Until patching, do not expose the router's management interface to the WAN and restrict access to /cgi-bin/cstecgi.cgi to trusted LAN clients. If services are terminated, a reboot of the device restores them.