CVE-2026-51690: Critical severity TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which devices are affected?
The affected product and version identified in the available data is TOTOLINK T6 firmware 4.1.5cu.748_B20211015.
2
Does exploitation require authentication?
No. An unauthenticated attacker can exploit the issue by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
3
What could an attacker change?
An attacker can alter upstream provisioning and connectivity through the setWanCfg function.