CVE-2026-51699: Critical severity TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
An attacker does not need to authenticate. Exploitation consists of sending a crafted POST request to the device's /cgi-bin/cstecgi.cgi endpoint targeting the setDmzCfg function.
2
What is the practical impact of a successful attack?
A successful attacker can expose an internal host by modifying the router's DMZ configuration. This can make that host reachable through the router in a way not intended by the administrator.
3
Which device and firmware version are identified as affected?
The reported affected product is the TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015.