TOTOLINK T6 CVE-2026-51720

Exploitation requires network reachability to the TOTOLINK T6's HTTP management endpoint /cgi-bin/cstecgi.cgi and the ability to send a crafted POST request invoking the delIpPortFilterRules function; per the CVSS vector (PR:N/UI:N) no authentication, credentials, or user interaction are needed against the affected firmware 4.1.5cu.748_B20211015. The primary limiting factor is exposure of the management interface: if remote/WAN administration is disabled (the common default), an attacker must already be on the LAN or wireless network, which substantially narrows realistic attackers to those with local network access. Only the named firmware build is confirmed vulnerable.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.1) reflects trivial, unauthenticated, low-complexity network exploitation, which is credible given the described single crafted POST. However, the vector's C:H/I:H/A:N impact rating is questionable: deleting firewall filter rules is fundamentally an integrity impact on the device's security configuration, with no direct confidentiality disclosure, so the C:H component looks overstated and I would assess confidentiality as indirect at most - verify with vendor. There is no EPSS score, no KEV listing, and no POC referenced, so exploitation is currently theoretical rather than observed, and the real-world danger depends heavily on whether the router's management interface is exposed to the WAN or only the LAN. Even so, because the vulnerability disarms the very firewall meant to protect the network, any operator with these devices at the edge should treat it as a high-priority patch/mitigation item rather than a paper-only high-CVSS finding.

An attacker who can reach the router's web interface (e.g., an Internet-exposed management port, or a foothold on the LAN/guest Wi-Fi) sends a single crafted POST to /cgi-bin/cstecgi.cgi invoking delIpPortFilterRules, requiring no credentials or user interaction. The device silently deletes its IP/port firewall filter rules, re-exposing internal hosts and services that those rules were blocking, which the attacker then scans and targets. No public POC is referenced, but the low complexity makes weaponization straightforward.