TOTOLINK T6 CVE-2026-51680

Exploitation requires network reachability to the TOTOLINK T6's HTTP management service and the ability to send a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint invoking the setLedCfg function; per CVSS PR:N/UI:N no authentication or user interaction is needed against the affected 4.1.5cu.748_B20211015 build. The primary limiting factor is exposure of the management interface: on a default deployment where remote (WAN) administration is disabled, an attacker must be on the local network, which sharply narrows the practical attack surface. The functional impact is also inherently limited to LED configuration, which constrains real-world severity regardless of reachability.

The signals conflict sharply and should be reconciled before prioritization. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, base 9.1) claims high confidentiality and integrity impact, but the description states the only attacker capability is modifying LED behavior - a cosmetic/indicator change with minimal security consequence - so the C:H/I:H rating appears substantially inflated relative to the stated impact. There is no EPSS score, no KEV listing, and no identified public exploit code, so there is no evidence of active or imminent exploitation. Realistically this is a low-to-moderate priority issue rather than a true critical: an internet-exposed management interface makes it remotely reachable, but the concrete impact is trivial unless setLedCfg is later found to enable broader configuration tampering. Organizations should verify the actual affected behavior with the vendor rather than acting on the 9.1 score alone, and treat any internet-facing TOTOLINK management interface as the more pressing exposure.

An attacker who can reach the router's HTTP management interface - for example an internet-exposed device or an attacker already on the LAN - sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking setLedCfg with no credentials, and the device applies the LED configuration change. Because AC:L/PR:N/UI:N, the request is simple and requires no authentication or user interaction, but no public exploit code has been identified.