CVE-2026-51677: Critical severity TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
No authentication is required. An attacker only needs to be able to send a crafted POST request to the device's /cgi-bin/cstecgi.cgi endpoint.
2
What can an attacker change if exploitation succeeds?
The attacker can change the state of the device's UPnP service through the setUPnPCfg function.
3
Which device and firmware are identified as affected?
The affected product identified in the available data is the TOTOLINK T6 running firmware 4.1.5cu.748_B20211015.