CVE-2026-51654: TOTOLINK T6 Authentication Bypass Flaw

CVE-2026-51654 Overview

CVE-2026-51654 is an incorrect access control vulnerability [CWE-284] in the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. The flaw resides in the getScheduleCfg function accessible through the /cgi-bin/cstecgi.cgi endpoint. Unauthenticated attackers on an adjacent network can send a crafted POST request to retrieve schedule and scheduled-reboot configuration information from the device. The vulnerability requires no user interaction and no privileges. Exposure of schedule configuration data can inform follow-on attacks by revealing operational patterns of the target device.

Critical Impact
Unauthenticated attackers on the local network can extract schedule and scheduled-reboot configuration data from TOTOLINK T6 routers by issuing a single crafted POST request.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
cstecgi.cgi CGI handler (getScheduleCfg function)

Discovery Timeline

2026-08-28 - CVE-2026-51654 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51654

Vulnerability Analysis

The TOTOLINK T6 router exposes an HTTP-based configuration interface through the cstecgi.cgi binary. This CGI handler routes JSON-formatted POST requests to internal functions based on a topicurl parameter. The getScheduleCfg function returns configuration data related to scheduled operations, including scheduled-reboot settings.

The handler does not verify that the requester holds a valid authenticated session before returning configuration data. Any host reachable on the router's LAN or wireless network can invoke the function. The disclosed data can support reconnaissance of network availability windows and administrative behavior. Because attackers must reach an adjacent network segment, remote internet-based exploitation is not directly possible without an existing foothold.

Root Cause

The root cause is a missing authorization check in the getScheduleCfg handler within cstecgi.cgi. The function processes POST requests and returns schedule data without validating the session token or verifying the caller's authentication state. This maps to [CWE-284] Improper Access Control.

Attack Vector

An attacker positioned on the adjacent network sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with a JSON body invoking the getScheduleCfg topic. The router responds with the current schedule configuration. No credentials, cookies, or session tokens are required. See the CVE coordination repository by DarkBoulder and the CVE coordination repository by ShengWu00 for the technical writeup.

Detection Methods for CVE-2026-51654

Indicators of Compromise

Unexpected HTTP POST requests to /cgi-bin/cstecgi.cgi originating from unmanaged LAN or wireless clients
Request bodies containing the getScheduleCfg topic value without a preceding authentication request
Repeated cstecgi.cgi calls from a single client enumerating multiple configuration functions

Detection Strategies

Inspect router web-management access logs for anonymous POST requests to cstecgi.cgi endpoints
Deploy network traffic analysis rules that flag calls to getScheduleCfg from non-administrative hosts
Correlate CGI access patterns against expected administrative source IPs and time windows

Monitoring Recommendations

Baseline normal management traffic to the router and alert on deviations in source, frequency, or request content
Monitor for reconnaissance chains where CVE-2026-51654 probes precede attempts against other TOTOLINK CGI functions
Log and retain HTTP request metadata for LAN-side access to embedded devices for forensic review

How to Mitigate CVE-2026-51654

Immediate Actions Required

Restrict access to the router's web-management interface to a dedicated administrative VLAN or trusted host list
Disable remote administration and verify that the CGI endpoint is not exposed to the WAN
Segment IoT and guest devices away from network segments that can reach the router management interface

Patch Information

No vendor patch has been published in the enriched data for CVE-2026-51654. Check the TOTOLINK firmware download page and the TOTOLINK official website for firmware updates for the T6 model. Apply the successor firmware to 4.1.5cu.748_B20211015 once available.

Workarounds

Place the T6 router management interface behind a firewall rule that permits only authorized administrator IPs
Enable client isolation on wireless networks to prevent adjacent LAN clients from reaching the router's HTTP service
Retire vulnerable devices where continued adjacent-network exposure cannot be eliminated

bash

# Example: restrict LAN access to router management interface using an upstream firewall
# Allow only the admin workstation to reach the router web UI
iptables -I FORWARD -s 192.0.2.10 -d 192.168.1.1 -p tcp --dport 80 -j ACCEPT
iptables -I FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP