CVE-2026-51704: TOTOLINK T6 vulnerability

Published Aug 31, 2026

Updated

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Affected Software

1 affected component

TOTOLINK T6=4.1.5cu.748_B20211015

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade TOTOLINK T6 4.1.5cu.748_B20211015 to a version that resolves this vulnerability.
Fixed in 4.1.5cu.748_B20211015
Compensating control
Block unauthenticated access to /cgi-bin/cstecgi.cgi (e.g., via firewall/WAF/ACL rules) so attackers cannot call setWiFiMeshConfig to alter WiFi mesh configurations.

Event History

Aug 31, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:18 PM

Description

Frequently Asked Questions

Which deployments are exposed?

The affected product and version identified are TOTOLINK T6 running firmware 4.1.5cu.748_B20211015. The vulnerable functionality is reachable through the router's CGI endpoint.

Does exploitation require authentication?

No. An unauthenticated attacker can alter mesh configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi targeting the setWiFiMeshConfig function.