CVE-2026-51734: Critical severity TOTOLINK T6 vulnerability
Published Aug 31, 2026
·Updated
Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which devices are exposed to this issue?
The affected product and firmware identified in the available data are TOTOLINK T6 devices running version 4.1.5cu.748_B20211015.
2
Does exploitation require authentication?
No. An unauthenticated attacker can trigger mesh slave update coordination by sending a crafted POST request to /cgi-bin/cstecgi.cgi.