TOTOLINK T6 CVE-2026-51718

Exploitation requires network reachability to the TOTOLINK T6 web management endpoint /cgi-bin/cstecgi.cgi and the ability to send a crafted POST invoking the delStaticDhcpRules function; per the CVSS vector (PR:N/UI:N) no authentication and no user interaction are needed against firmware 4.1.5cu.748_B20211015. The primary limiting factor is exposure of that interface: by default these routers expose management only on the LAN, so an attacker must typically already be on the local network unless remote/WAN administration has been enabled. Impact is also inherently limited to deletion of static DHCP reservations rather than full device takeover.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) correctly reflects that no authentication or user interaction is needed and the attack is low-complexity, but the C:H/I:H/A:H impact metrics that drive the 9.8 score are questionable: the described action only removes static DHCP reservations, which is a configuration-integrity and minor-availability issue rather than a confidentiality breach or full device compromise - CVSS indicates total impact but the description implies a narrowly scoped effect, so verify with the vendor. There is no EPSS value, no KEV listing, and no known public exploit in the provided data, so the practical exploitation signal is low despite the high nominal score. The most important limiting factor is exposure: SOHO routers rarely expose their LAN-side management interface to the internet by default, so realistic attackers are typically already on the local network, and only deployments with WAN administration enabled face remote risk. Overall this is a genuine unauthenticated access-control flaw but a lower real-world priority than 9.8 suggests, absent evidence of internet-wide exposure or active exploitation.

An attacker with network reach to the router's management interface (a device on the LAN, or the internet if WAN administration is enabled) sends a single crafted POST request to /cgi-bin/cstecgi.cgi invoking delStaticDhcpRules, deleting the configured static DHCP reservations without any credentials. This can disrupt hosts or services that depend on fixed IP assignments. No public proof-of-concept is identified at time of analysis, though the low complexity (AC:L) makes reproduction straightforward.