TOTOLINK T6 CVE-2026-51676

Exploitation requires network access to the TOTOLINK T6 web management interface and the ability to send a POST request to the /cgi-bin/cstecgi.cgi endpoint invoking the setAccessDeviceCfg function; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are needed against the affected firmware. The principal limiting factor is reachability: SOHO router admin interfaces are typically LAN-bound, so an internet-facing attack depends on remote/WAN administration being enabled, and a purely LAN-based attacker needs an existing foothold or physical/wireless network presence. Confirmed affected build is firmware 4.1.5cu.748_B20211015.

The signals point to a genuinely high-priority issue for exposed devices: the CVSS 3.1 base score is 9.1 with a fully remote, low-complexity, no-privilege, no-interaction vector, and the vulnerability class (unauthenticated config tampering) is directly actionable. However, real-world risk is strongly gated by exposure - SOHO routers are normally administered from the LAN, so the practical blast radius depends on whether the management interface is reachable from the WAN or from an attacker already on the local network. Contrasting the raw score with softer signals tempers urgency somewhat: there is no EPSS value supplied, no KEV listing, and no public PoC identified, so there is no evidence of active or automated exploitation yet. The CVSS vector's C:H claim is debatable - the described impact is policy alteration (integrity), so confidentiality impact may be overstated. Net: treat as urgent to patch on any T6 whose admin interface is exposed beyond the trusted LAN, while recognizing the absence of exploitation evidence means it is not (yet) a mass-exploited emergency.

An attacker with network reachability to the router's web interface - either because remote administration is exposed to the WAN or because they already have a foothold on the LAN - sends a single crafted, unauthenticated POST to /cgi-bin/cstecgi.cgi invoking setAccessDeviceCfg. With low attack complexity and no authentication, they overwrite access-device policies to weaken restrictions or grant themselves privileged access to devices on the network. No public PoC has been identified, but the request-based nature makes exploitation straightforward to script once the parameters are known.