CVE-2026-51675: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51675 Overview

CVE-2026-51675 is an incorrect access control vulnerability [CWE-284] in the setWanIeCfg function of the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can reconfigure uplink (WAN) settings by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The flaw exposes the device's internet-facing configuration to arbitrary modification without any credentials or user interaction. Successful exploitation allows adversaries to redirect traffic, disrupt connectivity, or pivot into the internal network.

Critical Impact
Unauthenticated network attackers can modify WAN uplink configuration on affected TOTOLINK T6 devices, enabling traffic redirection and network compromise.

Affected Products

TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015
Vendor: TOTOLINK (TOTOLINK Official Website)
Firmware distribution: TOTOLINK Download Page

Discovery Timeline

2026-08-31 - CVE-2026-51675 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51675

Vulnerability Analysis

The TOTOLINK T6 exposes a CGI handler at /cgi-bin/cstecgi.cgi that dispatches administrative operations by function name. The setWanIeCfg function processes WAN interface configuration requests but does not enforce authentication or session validation before applying changes. Any HTTP client that can reach the router's management interface can invoke the function directly. Because the WAN uplink governs how the router connects upstream, attackers can substitute attacker-controlled DNS servers, modify PPPoE credentials, or change the connection type to disable internet access. The EPSS score is 0.364% (29th percentile), reflecting current exploitation likelihood despite the low technical barrier.

Root Cause

The root cause is a missing authorization check [CWE-284] in the request handler. The CGI dispatcher trusts the function name supplied in the POST body and executes the corresponding configuration routine without verifying that the caller holds an active administrative session. Access control is neither enforced at the web server layer nor within setWanIeCfg itself.

Attack Vector

Exploitation requires only network reachability to the router's HTTP management interface. An attacker sends a single crafted POST request to /cgi-bin/cstecgi.cgi containing a JSON body that specifies the setWanIeCfg topic name and attacker-chosen WAN parameters. The device parses the payload and immediately applies the new uplink configuration. No credentials, tokens, or user interaction are required, and the request can be issued from the internet if the management interface is WAN-exposed. Technical details are documented in the TOTOLINK CVE Coordination Repository and a mirror coordination repository.

No verified proof-of-concept code has been published. See the referenced coordination repositories for advisory-level technical details.

Detection Methods for CVE-2026-51675

Indicators of Compromise

Unexpected HTTP POST requests to /cgi-bin/cstecgi.cgi referencing the setWanIeCfg function, especially from external or non-administrative source addresses.
Unauthorized changes to WAN connection type, DNS servers, PPPoE credentials, or gateway addresses in router configuration.
Router reboots or connectivity drops correlated with configuration change events in device logs.
Client devices resolving DNS through unfamiliar upstream resolvers after connecting to the affected router.

Detection Strategies

Monitor HTTP access logs on the router (where available) for POST requests to cstecgi.cgi originating outside the administrative subnet.
Inspect network traffic with an IDS rule that flags requests containing the setWanIeCfg topic identifier destined for TOTOLINK management endpoints.
Baseline WAN configuration values and alert on unauthorized drift using configuration management tooling.

Monitoring Recommendations

Track outbound DNS queries from the LAN for resolution against unapproved resolvers, which may indicate hijacked WAN DNS settings.
Log and review all administrative sessions to the router, correlating source addresses with expected administrator locations.
Alert on router configuration change events emitted via syslog or SNMP traps.

How to Mitigate CVE-2026-51675

Immediate Actions Required

Disable remote (WAN-side) management on the TOTOLINK T6 to restrict the attack surface to the local network.
Restrict access to the router's web management interface to a dedicated administrative VLAN or trusted host list.
Audit current WAN configuration for unauthorized DNS servers, connection types, or credentials, and restore known-good values.
Segment IoT and consumer-grade network equipment away from sensitive corporate assets.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-51675. Monitor the TOTOLINK Download Page for firmware updates addressing the setWanIeCfg access control flaw. Where a fixed firmware release is unavailable, consider replacing the device with a supported model that receives active security maintenance.

Workarounds

Place the router behind an upstream firewall that blocks inbound access to TCP ports 80 and 443 on the device's WAN interface.
Apply LAN-side access control lists that limit HTTP access to cstecgi.cgi to specific administrator workstations.
Change the default management port and disable UPnP to reduce discoverability by opportunistic scanners.
Isolate the affected device on a segmented network until a vendor fix is available.

bash

# Example upstream firewall rule (iptables) blocking WAN-side management access
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 443 -j DROP

# LAN-side restriction: allow only the admin workstation to reach the CGI endpoint
iptables -A FORWARD -s <admin_workstation_ip> -d <router_lan_ip> -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d <router_lan_ip> -p tcp --dport 80 -j DROP