CVE-2026-51694: TOTOLINK T6 Authentication Bypass Vulnerability

CVE-2026-51694 Overview

CVE-2026-51694 is an incorrect access control vulnerability in the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. The flaw resides in the setStaticDhcpRules function exposed through /cgi-bin/cstecgi.cgi. Unauthenticated attackers can add or modify static Dynamic Host Configuration Protocol (DHCP) rules by sending a crafted HTTP POST request. The vulnerability is classified under [CWE-284: Improper Access Control].

Critical Impact
Remote unauthenticated attackers can manipulate static DHCP bindings on affected TOTOLINK T6 devices, enabling IP-to-MAC mapping tampering that supports downstream network redirection and man-in-the-middle scenarios.

Affected Products

TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015
Devices exposing the cstecgi.cgi management endpoint
Deployments where the web management interface is reachable from untrusted networks

Discovery Timeline

2026-08-31 - CVE-2026-51694 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51694

Vulnerability Analysis

The TOTOLINK T6 web management interface exposes administrative functionality through the /cgi-bin/cstecgi.cgi handler. The setStaticDhcpRules action within this handler processes configuration changes for static DHCP reservations. The affected firmware does not enforce authentication or authorization checks before accepting configuration changes for this action.

An attacker who can reach the device on the network can submit a POST request that invokes setStaticDhcpRules and modify persistent DHCP configuration. Because the function alters IP-to-MAC bindings distributed by the router, successful exploitation directly affects the integrity of the local network's addressing state. The CWE-284 classification reflects the missing enforcement of access controls on an administrative operation.

The Exploit Prediction Scoring System (EPSS) rates the probability of exploitation at 0.264% (18th percentile) as of 2026-09-03. No public proof-of-concept exploit or CISA Known Exploited Vulnerabilities (KEV) listing is associated with this CVE.

Root Cause

The root cause is missing authentication and authorization checks on the setStaticDhcpRules code path within cstecgi.cgi. The handler dispatches to the function based on request parameters without validating a session token or administrator credentials. Any client capable of delivering an HTTP request to the management interface can invoke the operation.

Attack Vector

Exploitation requires network access to the router's HTTP management interface and no user interaction. The attacker crafts a POST request to /cgi-bin/cstecgi.cgi selecting the setStaticDhcpRules action and supplies attacker-controlled MAC address, IP address, and rule parameters. See the GitHub CVE Coordination Repository for coordination details and additional context. No verified proof-of-concept code is published for CVE-2026-51694; the vulnerability is described in prose based on the vendor coordination materials.

Detection Methods for CVE-2026-51694

Indicators of Compromise

Unexpected POST requests to /cgi-bin/cstecgi.cgi referencing the setStaticDhcpRules action from unauthenticated sources.
Unauthorized additions or modifications to static DHCP reservation entries in the router configuration.
New IP-to-MAC bindings that steer client traffic to attacker-controlled addresses.

Detection Strategies

Monitor HTTP access logs on the router or upstream inspection points for requests to cstecgi.cgi originating from outside the administrative subnet.
Baseline the current static DHCP rule set and alert on configuration drift.
Inspect DHCP lease tables for reservations that do not correlate with authorized change tickets.

Monitoring Recommendations

Forward router syslog, DHCP, and web management events to a central logging platform for correlation and long-term retention.
Alert on Address Resolution Protocol (ARP) anomalies and duplicate IP conditions that can follow static DHCP tampering.
Track management-plane traffic to network devices and flag POST activity from non-administrator hosts.

How to Mitigate CVE-2026-51694

Immediate Actions Required

Restrict access to the TOTOLINK T6 web management interface to trusted administrator subnets using firewall or access control list (ACL) rules.
Disable remote (WAN-side) management on affected devices until a vendor patch is verified as installed.
Audit and reconcile static DHCP rules on affected routers to identify unauthorized entries.

Patch Information

No fixed firmware version is referenced in the NVD entry for CVE-2026-51694 at publication. Administrators should monitor the TOTOLINK Firmware Download Page and the TOTOLINK Official Website for updates addressing the setStaticDhcpRules access control issue and apply firmware updates as soon as they are published.

Workarounds

Place affected routers behind a network segmentation boundary that blocks unauthenticated HTTP access to /cgi-bin/cstecgi.cgi.
Replace the affected firmware version 4.1.5cu.748_B20211015 on business-critical deployments with an alternative device if a patch is not available.
Enable and review DHCP snooping and dynamic ARP inspection on upstream switches to limit downstream impact of manipulated bindings.

bash

# Example: restrict router management interface to a trusted admin subnet
# Adjust interface names and subnets to match your environment
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP