CVE-2026-51742: Medium severity TOTOLINK T6 vulnerability
Published Sep 1, 2026
·Updated
Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Sep 1, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·01:19 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker can trigger the affected WAN discovery logic. The description does not state that prior login, credentials, or other privileges are required.
2
What request path is involved?
The affected functionality is reachable through a crafted POST request to /cgi-bin/cstecgi.cgi.
3
Which product version is identified as affected?
The reported affected version is TOTOLINK T6 4.1.5cu.748_B20211015.