CVE-2026-51702: TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter firewall policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:18 PM
Description
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
An attacker does not need to authenticate. Exploitation involves sending a crafted POST request to /cgi-bin/cstecgi.cgi that reaches the setIpPortFilterRules function.
2
What security impact can exploitation have?
An attacker can alter firewall policies on the affected device. The provided information does not specify which firewall rules can be changed or whether the management endpoint must be reachable from a particular network.