TOTOLINK T6 CVE-2026-51695

The router's web management interface (/cgi-bin/cstecgi.cgi) must be reachable by the attacker over the network. No authentication or session token is required - the CVSS vector PR:N confirms unauthenticated exploitation. By default, TOTOLINK consumer routers typically expose management only on the LAN interface, meaning exploitation from the internet requires WAN management to be explicitly enabled. Exploitation from within the LAN (e.g., by a malicious device on the local network) requires no special configuration. No specific OS, browser, or user interaction is involved. The limiting factor for most deployments is network reachability: attackers on the public internet are blocked unless remote management is enabled, whereas any LAN-connected device can trivially exploit this.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) scores 7.5 (High), reflecting a network-reachable, zero-complexity, unauthenticated attack - consistent with the missing authentication check described. The integrity impact is rated High because DDNS state can be fully overwritten. However, real-world risk is moderated by several factors: EPSS at 0.16% (6th percentile) is very low, indicating the broader threat intelligence community does not expect widespread automated exploitation; the vulnerability is not listed in CISA KEV; and the impact is confined to DDNS configuration rather than code execution or credential exposure. The attack surface is further bounded by typical router deployment postures - the management interface is usually LAN-only by default, limiting exposure to local-network attackers unless the owner has enabled remote WAN management. CVSS does not account for this deployment constraint, making the raw score somewhat misleading for environments with no WAN management exposure.

An attacker with network access to the router's web management interface sends an unauthenticated POST request to /cgi-bin/cstecgi.cgi with a crafted body invoking the setDdnsCfg action and arbitrary DDNS parameters. Because no authentication check is enforced, the router accepts and applies the configuration, potentially redirecting the device's dynamic DNS hostname to an attacker-controlled IP. GitHub-hosted vendor-coordination repositories associated with the discovering researchers suggest proof-of-concept material exists.