TOTOLINK T6 CVE-2026-51711

Triggering the WPS window requires only network reachability of the HTTP endpoint /cgi-bin/cstecgi.cgi on a TOTOLINK T6 running firmware 4.1.5cu.748_B20211015, with no authentication (PR:N), no user interaction, and a crafted POST calling the setWiFiWpsStart function - so the trigger itself has no special configuration prerequisite beyond the endpoint being reachable. The key LIMITING factor is that turning realized impact (network access, data exposure) into reality requires the attacker to be within wireless radio range to complete WPS pairing, and the affected management interface must be reachable from the attacker's network position (LAN by default, or WAN only if remote management is exposed). Exploitation is also constrained to the specific device model and firmware build named; other builds are unverified.

Signals are mixed. The NVD CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting an unauthenticated, low-complexity network trigger with claimed high confidentiality and integrity impact. However, the described direct effect - opening a WPS pairing window - does not by itself disclose or modify data; the high C/I impact is only realized if an attacker within Wi-Fi radio range then completes WPS pairing to join the network, which is an adjacency-dependent follow-on step not captured by AV:N. This suggests the 9.1 may overstate the immediately exploitable impact: the HTTP trigger is remote, but meaningful compromise requires physical proximity to the wireless network. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation. Realistic priority is moderate for internet-exposed management interfaces and higher for environments where the router's WAN/management is reachable and an attacker can be within wireless range; treat as a real but conditionally-impactful issue rather than a mass-exploitation emergency.

An attacker who can reach the router's web interface sends a single crafted unauthenticated POST request to /cgi-bin/cstecgi.cgi invoking setWiFiWpsStart, causing the device to open its WPS pairing window. Positioned within Wi-Fi range, the attacker then completes WPS association to join the network without knowing the passphrase, gaining LAN access to intercept traffic or pivot to internal devices. No public POC is referenced, so exploitation would require crafting the request from knowledge of the CGI function.