CVE-2026-51692: TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to establish or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Which deployments are exposed?
TOTOLINK T6 devices running firmware version 4.1.5cu.748_B20211015 are identified as affected. The issue is reachable through the device's CGI endpoint at /cgi-bin/cstecgi.cgi.
2
Does exploitation require authentication or prior access?
No. An unauthenticated attacker can exploit the issue by sending a crafted POST request to the affected CGI endpoint.
3
What could an attacker change?
An attacker can establish guest wireless access or weaken the existing guest wireless access configuration.