CVE-2026-51679: Critical severity TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker only needs to send a crafted POST request to /cgi-bin/cstecgi.cgi. Authentication is not required.
2
What is the impact of successful exploitation?
An attacker can change the router's administrator account, which can result in unauthorized administrative control.
3
Which product version is identified as affected?
The issue is identified in TOTOLINK T6 firmware version 4.1.5cu.748_B20211015.