CVE-2026-51666: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51666 Overview

CVE-2026-51666 is an incorrect access control vulnerability in the setWizardCfg function of the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers on an adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to reconfigure WAN settings, Wi-Fi parameters, and device initialization state. The flaw maps to CWE-284: Improper Access Control. Successful exploitation lets attackers hijack network configuration without any credentials, though the attack requires adjacency to the target device.

Critical Impact
An unauthenticated adjacent-network attacker can silently reconfigure WAN, Wi-Fi, and initialization state on affected TOTOLINK T6 routers by sending a single crafted HTTP POST request.

Affected Products

TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015

Discovery Timeline

2026-08-31 - CVE-2026-51666 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51666

Vulnerability Analysis

The TOTOLINK T6 web management interface exposes the CGI endpoint /cgi-bin/cstecgi.cgi, which routes incoming JSON POST requests to internal handler functions based on a topicurl parameter. The setWizardCfg handler configures initial setup values including WAN connection type, Wi-Fi SSID and passphrase, and the device's initialization flag.

The handler does not validate whether the requester has authenticated to the device. Any client that can reach the LAN or wireless interface can invoke setWizardCfg and overwrite these settings. Because the wizard controls first-boot state, an attacker can also reset the router into initialization mode, which forces reconfiguration on the next administrative access.

Root Cause

The root cause is a missing authentication check inside the setWizardCfg dispatch path in cstecgi.cgi. Sensitive configuration functions should be gated behind session validation, but this handler processes requests directly from the parsed request body. This is a classic broken access control pattern where a privileged administrative action is reachable without an authenticated session.

Attack Vector

The attack vector is adjacent network access, meaning the attacker must be on the same LAN, VLAN, or Wi-Fi network as the router. An attacker joins the network, then issues an HTTP POST request to /cgi-bin/cstecgi.cgi with a JSON payload targeting topicurl=setWizardCfg and attacker-chosen WAN and Wi-Fi values. The router applies the configuration without verifying identity. See the vendor coordination advisory for coordination details and the TOTOLINK firmware download page for firmware references.

Detection Methods for CVE-2026-51666

Indicators of Compromise

Unexpected changes to WAN connection type, Wi-Fi SSID, or Wi-Fi passphrase on TOTOLINK T6 devices.
HTTP POST requests to /cgi-bin/cstecgi.cgi containing a topicurl value of setWizardCfg from LAN or wireless clients.
The router returning to first-run wizard state without an administrator-initiated reset.

Detection Strategies

Inspect router HTTP access logs, where available, for POST requests to cstecgi.cgi sourced from unexpected internal hosts.
Baseline router configuration values and alert on drift in WAN, Wi-Fi, and initialization flags.
Monitor DHCP and ARP tables for unauthorized wireless clients that could reach the management interface.

Monitoring Recommendations

Forward network flow records and DHCP logs into a centralized analytics platform to spot unusual internal-to-router traffic patterns.
Alert when management-interface traffic originates from guest or IoT VLANs that should not reach infrastructure devices.
Track configuration snapshots of consumer and SMB routers so that unauthorized wizard resets trigger investigation.

How to Mitigate CVE-2026-51666

Immediate Actions Required

Restrict access to the TOTOLINK T6 management interface to a dedicated administrative VLAN or specific trusted hosts.
Isolate untrusted wireless clients using guest network segmentation so they cannot reach /cgi-bin/cstecgi.cgi.
Change Wi-Fi credentials and audit current WAN and Wi-Fi configuration for unexpected values.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Administrators should monitor the TOTOLINK official website and the TOTOLINK firmware download page for updated firmware that addresses the setWizardCfg access control flaw.

Workarounds

Disable remote and Wi-Fi based access to the router web UI, allowing management only from a wired trusted host.
Place the router behind an upstream firewall that filters HTTP requests to cstecgi.cgi from non-administrative segments.
Replace affected devices in high-risk environments if no firmware fix becomes available.

bash

# Configuration example: block LAN clients from reaching the router web UI
# except from a specific admin workstation (adapt to your firewall syntax)
iptables -I FORWARD -d 192.168.1.1 -p tcp --dport 80 -s 192.168.1.10 -j ACCEPT
iptables -I FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP