CVE-2026-51674: TOTOLINK T6 Authentication Bypass Flaw

CVE-2026-51674 Overview

CVE-2026-51674 is an incorrect access control vulnerability in the setScheduleCfg function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can send a crafted HTTP POST request to /cgi-bin/cstecgi.cgi and configure forced reboot tasks on the device. The flaw is classified under [CWE-284: Improper Access Control] and is reachable over the network without any user interaction.

Critical Impact
Remote, unauthenticated attackers can schedule forced reboots on affected TOTOLINK T6 devices, causing recurring denial of service and potential disruption to any network segment served by the router.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
Web management interface exposed via /cgi-bin/cstecgi.cgi

Discovery Timeline

2026-08-31 - CVE-2026-51674 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51674

Vulnerability Analysis

The TOTOLINK T6 web management interface exposes the cstecgi.cgi binary, which dispatches configuration actions based on JSON fields in POST bodies. The setScheduleCfg handler creates or modifies scheduled tasks, including forced reboots. On the affected firmware, this handler does not verify the caller's authentication state or session token before processing the request. Any host that can reach the router's HTTP interface can invoke the handler and persist a reboot schedule.

An attacker abusing this endpoint can force the device to reboot at arbitrary intervals. Recurring reboots interrupt routing, DHCP, DNS, VPN tunnels, and any dependent services. In environments where the T6 fronts an internal network, this produces a persistent denial-of-service condition until an administrator inspects and clears the scheduled task.

Root Cause

The root cause is missing authorization enforcement on a privileged configuration function. The setScheduleCfg action should require an authenticated administrative session, but the handler processes the request based only on the presence of expected JSON parameters. This is a canonical instance of [CWE-284], where a sensitive operation is exposed without an access control check.

Attack Vector

Exploitation requires only network access to the router's HTTP interface. The attacker sends a POST request to /cgi-bin/cstecgi.cgi with a JSON body specifying the setScheduleCfg action and the desired reboot schedule parameters. No credentials, cookies, or CSRF tokens are validated. When the T6 management interface is exposed to untrusted networks or reachable through a compromised internal host, remote adversaries and LAN-side attackers can trigger the flaw at will. Refer to the GitHub Vendor Coordination Resource for additional technical context.

Detection Methods for CVE-2026-51674

Indicators of Compromise

Unexpected POST requests to /cgi-bin/cstecgi.cgi referencing the setScheduleCfg action from unauthenticated sources.
New or unexplained scheduled reboot entries in the TOTOLINK T6 configuration.
Recurring, unscheduled device reboots visible in uptime metrics or upstream link-state logs.

Detection Strategies

Inspect router HTTP access logs (or upstream proxy logs) for POST requests to cstecgi.cgi that do not correlate with an authenticated admin session.
Alert on schedule configuration changes made outside approved change windows.
Monitor SNMP or syslog data for repeated reboot events on TOTOLINK T6 devices.

Monitoring Recommendations

Forward router syslog and web server logs to a centralized log platform for correlation and long-term retention.
Baseline expected administrative activity against cstecgi.cgi and alert on deviations.
Track device uptime as a health metric and trigger an incident when reboot frequency exceeds a defined threshold.

How to Mitigate CVE-2026-51674

Immediate Actions Required

Restrict access to the T6 web management interface to trusted management VLANs; block WAN-side access to /cgi-bin/cstecgi.cgi.
Audit the current scheduled task configuration on affected devices and remove any unrecognized reboot schedules.
Change administrative credentials after remediation to invalidate any residual attacker-configured sessions.

Patch Information

No vendor patch has been referenced in the published CVE record. Check the TOTOLink Official Website and the TOTOLink Download Page for firmware updates addressing the setScheduleCfg access control issue. Apply updates as soon as they become available.

Workarounds

Place the T6 management interface behind an ACL that permits only known administrative IP addresses.
Disable remote (WAN) management on the router.
Segment the router from untrusted internal hosts using firewall rules to reduce the reachable attack surface.
Consider replacing the affected device if firmware updates remain unavailable and exposure cannot be reduced.

bash

# Example: restrict inbound access to the router management interface at an upstream firewall
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 80 -s <ADMIN_SUBNET> -j ACCEPT
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 80 -j DROP