CVE-2026-51706: TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade traffic handling via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:18 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker can exploit it, so no prior login is required. Exposure depends on whether the device's web interface can be reached by the attacker.
2
What does an attacker need to send?
The issue is triggered by a crafted POST request to /cgi-bin/cstecgi.cgi targeting the setSmartQosCfg function.
3
What is the likely impact of successful exploitation?
Successful exploitation can degrade traffic handling by altering Smart QoS-related configuration behavior.