CVE-2026-51689: TOTOLINK T6 vulnerability

Published Aug 31, 2026

Updated

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Affected Software

1 affected component

TOTOLINK T6=4.1.5cu.748_B20211015

Event History

Aug 31, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments are exposed?

TOTOLINK T6 devices running firmware version 4.1.5cu.748_B20211015 are identified as affected. The issue is reachable through the device's CGI endpoint at /cgi-bin/cstecgi.cgi.

What does an attacker need to exploit this issue?

An attacker does not need to authenticate. Exploitation requires sending a crafted POST request to /cgi-bin/cstecgi.cgi that invokes the setUpgradeFW function.

What is the impact of successful exploitation?

An unauthenticated attacker can trigger changes to the firmware-upgrade workflow. The provided information does not specify whether this results in firmware installation, device takeover, or another outcome.