TOTOLINK T6 CVE-2026-51694

No authentication or special configuration is required - the CVSS vector PR:N/AC:L/AV:N confirms unauthenticated network exploitation against the default firmware configuration of the TOTOLINK T6. The only prerequisite is network reachability to the router's HTTP management interface (typically port 80 on the LAN-side IP). Exploitation is limited by: (1) the management interface typically being LAN-accessible only and not exposed to the internet by default; (2) the impact being confined to DHCP rule manipulation without confidentiality or availability impact. Attackers already on the LAN or with access to a network-adjacent position face no further barriers.

CVSS 7.5 (High) correctly reflects the trivially exploitable network attack surface and high integrity impact, but the EPSS score of 0.16% (6th percentile) indicates very low observed exploitation probability in the wild. The vulnerability is not listed in CISA KEV. The gap between CVSS severity and EPSS likelihood is consistent with a researcher-discovered flaw in a niche consumer router that is rarely exposed directly to the internet. Real-world risk is primarily relevant to networks where the TOTOLINK T6 management interface is reachable without firewall restriction - exposure from LAN-side attackers (e.g., compromised devices on the same segment) is the more realistic threat model than internet-facing exploitation. No conflicting signals exist across the available data; the low EPSS simply reflects limited deployment scale and no observed mass exploitation campaign.

An attacker on the same LAN segment - or on any network segment that can reach the router's HTTP management port - sends a crafted POST request to /cgi-bin/cstecgi.cgi invoking the setStaticDhcpRules action with attacker-controlled parameters. No credentials, session tokens, or prior reconnaissance are required. The attacker can inject malicious DHCP static mappings, redirecting specific MAC addresses to rogue IP assignments to facilitate man-in-the-middle positioning or network disruption.