CVE-2026-51628 Overview
CVE-2026-51628 is an incorrect access control vulnerability in the getGenerateWiFiWpsPin function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated attackers to generate and retrieve a new Wi-Fi Protected Setup (WPS) PIN by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability maps to [CWE-284: Improper Access Control] and requires no authentication, no user interaction, and can be exploited over the network.
Critical Impact
An unauthenticated remote attacker can force the router to generate a new WPS PIN and retrieve it, enabling wireless network compromise and downstream attacks against connected clients.
Affected Products
- TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015
- Devices exposing the cstecgi.cgi management endpoint
- Deployments with WPS functionality enabled
Discovery Timeline
- 2026-08-28 - CVE-2026-51628 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-51628
Vulnerability Analysis
The TOTOLINK T6 web management interface exposes multiple functions through the cstecgi.cgi CGI handler at /cgi-bin/cstecgi.cgi. One of these functions, getGenerateWiFiWpsPin, is responsible for generating a fresh WPS PIN for the wireless interface.
The function does not enforce authentication or session validation before executing. Any client capable of reaching the device's HTTP interface can invoke it. Successful invocation both regenerates the WPS PIN on the device and returns the new PIN in the HTTP response.
Because WPS PINs directly grant access to the Wi-Fi network, an attacker gains a working credential without needing to crack WPA2 handshakes, brute-force the PIN, or interact with a legitimate user.
Root Cause
The root cause is a missing authorization check on the getGenerateWiFiWpsPin handler inside cstecgi.cgi. Sensitive administrative functions must validate an authenticated session token before execution, but this handler treats the request as public. This is a classic instance of [CWE-284] where security-relevant functionality is reachable without credentials.
Attack Vector
The attack is delivered over the network as a single HTTP POST request. An attacker with access to the router's management interface, whether on the LAN, over the WAN if remote administration is enabled, or through a chained SSRF, sends a JSON payload targeting the getGenerateWiFiWpsPin action. The device responds with the newly generated PIN. The attacker then uses the PIN with a standard WPS supplicant to associate with the wireless network. See the CVE Vendor Coordination Advisory for coordination details.
No verified public exploit code is available at the time of publication. Refer to the ShengWu00 Coordination Repository for further technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-51628
Indicators of Compromise
- Unexpected HTTP POST requests to /cgi-bin/cstecgi.cgi referencing the getGenerateWiFiWpsPin action from untrusted source addresses.
- Router logs showing WPS PIN regeneration events without a corresponding administrator session.
- New or unknown wireless clients associating shortly after a WPS PIN change.
Detection Strategies
- Inspect HTTP traffic to the router management interface for POST bodies containing the getGenerateWiFiWpsPin topic name.
- Alert on any access to cstecgi.cgi originating from WAN-side addresses when remote management should be disabled.
- Correlate WPS PIN changes with authenticated admin sessions; divergence indicates abuse.
Monitoring Recommendations
- Enable syslog forwarding from the T6 router to a centralized logging platform and retain HTTP request logs.
- Monitor DHCP and association logs for unauthorized clients joining the wireless network.
- Track configuration change events, particularly WPS-related settings, in your network monitoring stack.
How to Mitigate CVE-2026-51628
Immediate Actions Required
- Disable WPS on the TOTOLINK T6 router until a vendor-supplied firmware update is applied.
- Restrict access to the router's HTTP management interface to trusted management VLANs only.
- Disable remote (WAN-side) administration if it is currently enabled.
- Rotate the Wi-Fi Pre-Shared Key (PSK) and audit connected clients for unknown devices.
Patch Information
No confirmed patched firmware release has been published in the CVE record. Monitor the TOTOLINK Download Page and the TOTOLINK Official Website for firmware updates addressing the getGenerateWiFiWpsPin handler. Apply vendor updates immediately once released.
Workarounds
- Turn off WPS in the router's wireless configuration to neutralize the exploit outcome, since a leaked PIN is useless if WPS is disabled.
- Place the router behind a segmentation firewall that blocks unsolicited inbound HTTP requests to /cgi-bin/cstecgi.cgi.
- Replace end-of-life or unmaintained TOTOLINK T6 units with actively supported hardware if the vendor does not release a fix.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
