CVE-2026-51714: TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter roaming behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:18 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker able to send HTTP POST requests to the affected router's management endpoint can exploit it. The issue is in the setRoamingCfg function exposed through /cgi-bin/cstecgi.cgi.
2
What access or interaction does an attacker need?
The attacker needs to send a crafted POST request to the device. No authentication is required according to the vulnerability information.
3
What is the impact of successful exploitation?
A successful attacker can alter the router's roaming behavior. The provided information does not specify which roaming settings can be changed or any resulting network impact.