CVE-2026-51687: TOTOLINK T6 vulnerability

Published Aug 31, 2026

Updated

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Affected Software

1 affected component

TOTOLINK T6=4.1.5cu.748_B20211015

Event History

Aug 31, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker can exploit it without authentication by sending a crafted POST request to /cgi-bin/cstecgi.cgi targeting the setWiFiEasyGuestCf function.

Which deployments are exposed?

TOTOLINK T6 devices running firmware version 4.1.5cu.748_B20211015 are identified as affected. The issue concerns guest wireless configuration, allowing an attacker to create or weaken guest access.

How can I check for possible exploitation?

Review HTTP request logs, if available, for unauthenticated POST requests to /cgi-bin/cstecgi.cgi, particularly requests invoking setWiFiEasyGuestCf. Also inspect the current guest Wi-Fi settings for unexpected enablement or weakened access controls.