TOTOLINK T6 CVE-2026-51709

Exploitation requires network reachability to the TOTOLINK T6's web management endpoint /cgi-bin/cstecgi.cgi and the ability to send a POST invoking the setWiFiBasicCfg function; per the CVSS vector (PR:N/UI:N) no credentials and no user interaction are needed, matching the description's 'unauthenticated attackers.' The concrete prerequisite is simply HTTP access to that CGI dispatcher on the affected firmware build 4.1.5cu.748_B20211015. Limiting factors that reduce real-world reach: the management interface is typically LAN-side only unless remote administration is enabled, so a practical attacker usually needs to already be on the local/Wi-Fi network or find a device with WAN-exposed administration; exploitation is also tied to this TOTOLINK model/firmware and does not generalize to unrelated devices.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated attack - the classic worst-case profile for an embedded device. However, several corroborating signals are absent: there is no EPSS probability, no CISA KEV listing (not actively exploited per available data), and no published POC in the references, so the 9.8 is a theoretical maximum rather than a demonstrated mass-exploitation event. Real-world exposure is also tempered by network topology: SOHO routers are typically not reachable from the public Internet on their LAN management interface unless remote administration is enabled, so 'AV:N' in practice usually means an attacker already on the LAN/Wi-Fi or via a WAN-exposed panel. I also assess the confidentiality impact as overstated - the function reconfigures rather than reads sensitive data - which is reflected in my independent scoring below. Net: a genuine high-severity integrity/availability issue for exposed or LAN-adjacent devices, but the lack of KEV/EPSS/POC suggests it is not currently seeing widespread automated exploitation.

An attacker who can reach the router's management interface - a malicious client already on the Wi-Fi/LAN, or a remote attacker where WAN administration is exposed - sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking setWiFiBasicCfg with attacker-chosen wireless parameters. Because no authentication is enforced, the router applies the new SSID and security settings, letting the attacker rename the network, weaken or change its passphrase, and knock legitimate clients offline or lure them onto an attacker-controlled configuration. No public POC is referenced, but the attack is a straightforward scripted HTTP request requiring no user interaction.