CVE-2026-51635: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51635 Overview

CVE-2026-51635 is an access control vulnerability affecting the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. The flaw resides in the getWiFiScheduleCfg function exposed through the /cgi-bin/cstecgi.cgi endpoint. Unauthenticated attackers on an adjacent network can send a crafted POST request to retrieve Wi-Fi scheduling rules from the device. The vulnerability is categorized under [CWE-284: Improper Access Control].

Critical Impact
Attackers within radio or LAN range can enumerate Wi-Fi scheduling configuration without any authentication, exposing operational patterns of the wireless network.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
Devices exposing /cgi-bin/cstecgi.cgi on adjacent networks

Discovery Timeline

2026-08-28 - CVE-2026-51635 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51635

Vulnerability Analysis

The TOTOLINK T6 web management interface exposes multiple handlers through the CGI binary at /cgi-bin/cstecgi.cgi. The getWiFiScheduleCfg handler returns the Wi-Fi scheduling configuration, which controls when wireless radios are enabled or disabled. This handler does not verify that the requester holds an authenticated administrative session. Any client capable of reaching the router's HTTP interface on the adjacent network can invoke the function and receive scheduling data in the response.

While the disclosed data is limited to Wi-Fi scheduling rules, attackers can use this information to profile the target environment. Knowledge of when the wireless network is offline supports timing attacks against downstream services or physical intrusion planning. The issue is representative of a broader class of missing authorization checks on SOHO router CGI endpoints.

Root Cause

The getWiFiScheduleCfg function is registered as a callable action within cstecgi.cgi without an accompanying session or token validation step. The dispatcher routes the POST request to the handler based solely on the action parameter supplied in the request body, then serializes the internal configuration structure back to the caller.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must be associated with the wireless LAN or connected to the same broadcast domain as the router. The attacker issues a POST request to /cgi-bin/cstecgi.cgi specifying the getWiFiScheduleCfg action. No credentials, cookies, or CSRF tokens are required. The device returns the configured schedule in the HTTP response. Refer to the GitHub CVE Coordination Document for the coordinated disclosure record.

Detection Methods for CVE-2026-51635

Indicators of Compromise

Unauthenticated POST requests to /cgi-bin/cstecgi.cgi containing the getWiFiScheduleCfg action parameter
HTTP requests to the router management interface originating from unexpected wireless clients
Repeated enumeration of CGI action names against the router within short time windows

Detection Strategies

Inspect router access logs and upstream network telemetry for requests targeting cstecgi.cgi handlers without prior authentication flows
Baseline expected administrative source addresses and alert on management-plane requests from other segments
Correlate wireless association events with subsequent HTTP requests to the router's management interface

Monitoring Recommendations

Forward router syslog and DHCP lease data to a centralized log platform for retention and correlation
Monitor for anomalous scanning behavior against SOHO device management ports on internal networks
Track firmware versions across deployed TOTOLINK devices to identify hosts still running 4.1.5cu.748_B20211015

How to Mitigate CVE-2026-51635

Immediate Actions Required

Restrict access to the router administrative interface to trusted management VLANs or wired segments only
Disable remote management features and block WAN access to /cgi-bin/cstecgi.cgi
Segment guest and IoT wireless networks so untrusted clients cannot reach the router management interface

Patch Information

At the time of publication, no vendor fix is referenced in the NVD entry for CVE-2026-51635. Administrators should consult the TOTOLINK Download Page for firmware updates addressing the getWiFiScheduleCfg access control issue, and review the TOTOLINK Official Website for security advisories.

Workarounds

Enforce WPA2/WPA3 with strong pre-shared keys to reduce the pool of clients able to reach the adjacent network
Place the router management interface behind an ACL that permits only administrator workstations
Replace end-of-support TOTOLINK T6 devices with hardware that receives active firmware maintenance

bash

# Example: block wireless clients from reaching the router management CGI
# using a downstream firewall between the AP and gateway
iptables -A FORWARD -i wlan0 -d 192.168.0.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -i wlan0 -d 192.168.0.1 -p tcp --dport 443 -j DROP