What is the CVSS score of CVE-2026-51691?

CVE-2026-51691 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-51691?

Within 24 hours, conduct a complete inventory of TOTOLINK T6 routers and identify all devices running firmware 4.1.5cu.748_B20211015 or earlier; immediately apply firewall rules to restrict access to ports 80 and 443 to authorized management networks only and disable remote web access if enabled. Within 7 days, implement network segmentation using dedicated VLANs for TOTOLINK T6 management access, remove the devices from general production network paths where possible, and configure access control lists to deny inbound connections from untrusted segments. Within 30 days, monitor TOTOLINK vendor advisories for patch release; if no patch is released within 60 days, initiate device replacement planning; concurrently, deploy intrusion detection signatures targeting suspicious POST requests to /cgi-bin/cstecgi.cgi with setUploadSetting parameters.

TOTOLINK T6 CVE-2026-51691

EUVD-2026-68586 CRITICAL

Improper Access Control (CWE-284)

2026-08-31 mitre

GHSA-mjfm-jjc7-32ch

Authentication Bypass

9.8

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach T6 web interface on LAN/WAN
Delivery

Send crafted POST to /cgi-bin/cstecgi.cgi
Exploit

Invoke setUploadSetting without auth
Execution

Alter upload/flash workflow settings
Impact

Corrupt or hijack firmware update (DoS/tamper)

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network access to the TOTOLINK T6 web interface (/cgi-bin/cstecgi.cgi) on firmware 4.1.5cu.748_B20211015 and the ability to send a POST request invoking the setUploadSetting function; per CVSS PR:N/UI:N no authentication or user interaction is needed against the default configuration. Practical limiting factors: the management interface is LAN-facing by default, so remote (WAN) exploitation depends on remote administration being enabled or the device being internet-exposed; impact is bounded to the upload/flash workflow rather than a general-purpose command execution primitive from the description alone.
Impact	The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) reflects trivial unauthenticated network reach, which is consistent with the description. However, the C:H (high confidentiality) rating appears overstated: setUploadSetting is a state-changing setter over the upload/flash workflow, so the concrete impact is integrity and availability (tampering with or bricking a firmware update), not information disclosure - the confidentiality impact is not evidenced by the description. Countering the high CVSS, EPSS is only 0.18% (7th percentile) and the CVE is not in CISA KEV, with no POC referenced, suggesting this is a high-severity-but-not-currently-exploited-at-scale issue typical of the many MITRE-published TOTOLINK research CVEs. Realistic priority is elevated for internet-exposed or LAN-adjacent T6 devices (the router is EoL-class consumer gear), but the practical blast radius depends on whether the flash workflow can be fully abused for persistent implant versus mere denial of service - the terse description does not confirm arbitrary firmware write.
Exploit ScenarioDerived	An attacker on the same LAN (or against a device with remote management exposed) sends a crafted POST request to /cgi-bin/cstecgi.cgi invoking setUploadSetting with no credentials, altering the upload/flash configuration. This can be used to disrupt or hijack a firmware update - at minimum denying service by corrupting the flash workflow, and potentially staging a malicious image push. No public POC is currently referenced, so exploitation would require reversing the handler's expected parameters.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 02, 2026

Unauthenticated manipulation of the firmware upload/flash workflow in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) is possible by sending crafted POST requests to the setUploadSetting handler in /cgi-bin/cstecgi.cgi, which lacks any authentication or access-control check (CWE-284). Any attacker with network reachability to the web interface can alter upload/flash settings, potentially corrupting or hijacking a firmware update and rendering the device inoperable. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), indicating no observed mass exploitation despite the 9.8 CVSS rating.

RemediationAI

No vendor-released patch identified at time of analysis; the referenced TOTOLINK pages are the download/coordination pages, so check for a firmware release newer than 4.1.5cu.748_B20211015 and apply it once published. As compensating controls: ensure the web management interface is never exposed to the WAN/internet (disable remote administration), which blocks the AV:N path entirely; restrict access to the LAN management IP via firewall/ACL to trusted admin hosts only, accepting the trade-off of less convenient management; place the router on a segmented VLAN so untrusted LAN/guest clients cannot reach /cgi-bin/cstecgi.cgi. Given the device is consumer-grade and likely EoL, plan replacement with a supported model if no firmware fix appears. Vendor coordination status can be tracked at https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md.

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The TOTOLINK T6 is a consumer mesh Wi-Fi router. Like most TOTOLINK SOHO devices, its web management interface routes all administrative actions through a single CGI dispatcher, /cgi-bin/cstecgi.cgi, which selects an internal handler by a function name in the JSON/POST body - here setUploadSetting, which governs the file-upload/firmware-flash workflow. The root cause is CWE-284 (Improper Access Control): the dispatcher invokes this sensitive handler without verifying an authenticated session or privilege level, so a request that should require an admin session is honored from an anonymous client. This is the same architectural weakness class seen across the T6 CGI endpoints (e.g. setUpgradeFW, setStorageCfg), where individual functions are not gated behind the login check.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.1 CRITICAL

Unauthenticated network access to an unprotected CGI setter (AV:N/AC:L/PR:N/UI:N); write-only upload/flash tampering yields I:H and A:H (possible bricking) but no data disclosure, so C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 02, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 31, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Aug 31, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Executive ViewAI

Why It Matters

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 and earlier contain an unauthenticated vulnerability that allows attackers to manipulate firmware upload operations without credentials, enabling potential device corruption or malicious firmware injection. Any organization with TOTOLINK T6 infrastructure faces the risk of network outages and device compromise, with no vendor patch currently available. This exposure is particularly acute because attackers need only network-level reachability to the router's web interface to trigger the vulnerability.

Business Impact: High

Compensating Controls

Implement strict perimeter firewall rules limiting access to TOTOLINK T6 web management interface (TCP 80/443) to authorized administrative networks only. Deploy network segmentation via VLAN isolation to restrict device accessibility from general corporate or untrusted networks. Disable remote management functionality and enforce local-only administrative access where operationally feasible. Configure intrusion detection rules to alert on POST requests containing setUploadSetting parameters. Enable device-level logging for upload and firmware operations and forward logs to centralized SIEM for monitoring. Consider temporary device isolation or failover to alternative routing infrastructure if business continuity permits.

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Prevalence

Low

consumer TOTOLINK mesh router, niche/EoL-class SOHO footprint

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.