CVE-2026-51713: TOTOLINK T6 vulnerability
Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker able to send HTTP requests to the router's CGI interface can exploit it. Exposure is therefore greatest when the device management interface is reachable from an untrusted network.
What does exploitation require?
The attacker needs to send a crafted POST request to /cgi-bin/cstecgi.cgi targeting the setManualDialCfg function. No authentication is required.
What can an attacker change?
The issue allows manipulation of the WAN dial state, which can affect the router's WAN connection behavior.
How can I determine whether a device is affected?
Verify whether the device is a TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015. Review access to /cgi-bin/cstecgi.cgi and investigate unexpected POST requests associated with WAN dial-state changes.