CVE-2026-51704: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51704 Overview

CVE-2026-51704 is an incorrect access control vulnerability in the setWiFiMeshConfig function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated attackers on an adjacent network to alter mesh Wi-Fi configurations by sending a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint. The vulnerability is classified under [CWE-284] (Improper Access Control) and affects integrity of device configuration without requiring credentials or user interaction.

Critical Impact
An adjacent unauthenticated attacker can modify mesh network configuration on a vulnerable TOTOLINK T6 router, enabling downstream tampering with wireless network topology and client routing.

Affected Products

TOTOLINK T6 router firmware 4.1.5cu.748_B20211015
Web management interface exposing /cgi-bin/cstecgi.cgi
setWiFiMeshConfig handler within the CGI binary

Discovery Timeline

2026-08-31 - CVE-2026-51704 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51704

Vulnerability Analysis

The TOTOLINK T6 router exposes a Common Gateway Interface (CGI) binary at /cgi-bin/cstecgi.cgi that dispatches requests to internal handler functions based on parameters in the POST body. The setWiFiMeshConfig handler modifies the router's mesh Wi-Fi settings, which govern how the device participates in a multi-access-point wireless mesh.

The handler fails to verify that the requester holds a valid administrative session before applying configuration changes. Any client that can reach the LAN or Wi-Fi interface of the router can invoke the handler and rewrite mesh parameters. Attackers can leverage this to disrupt mesh operation, redirect wireless clients through attacker-controlled nodes, or degrade the wireless environment.

Root Cause

The root cause is missing authentication and authorization checks on the setWiFiMeshConfig code path inside cstecgi.cgi. Sensitive configuration handlers should validate the session token or authentication cookie before processing requests. In this firmware build, the check is either absent or bypassable, so the handler treats unauthenticated requests as trusted administrative actions.

Attack Vector

Exploitation requires network adjacency to the router, such as connection to its LAN port or Wi-Fi network. An attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with the topicurl (or equivalent) parameter set to setWiFiMeshConfig and mesh configuration fields in the request body. No credentials, tokens, or user interaction are required. Attackers on guest Wi-Fi networks that share the management VLAN with the router are within scope.

See the GitHub TOTOLINK Coordination Guide (DarkBoulder) and the GitHub TOTOLINK Coordination Guide (ShengWu00) for coordination details.

Detection Methods for CVE-2026-51704

Indicators of Compromise

Unexpected HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setWiFiMeshConfig action from non-administrative hosts.
Unauthorized changes to mesh Wi-Fi settings, including altered SSIDs, mesh peer lists, or backhaul channels.
Web server logs on the router showing configuration write operations without a preceding authenticated login.

Detection Strategies

Inspect router HTTP access logs, where available, for POST requests to cstecgi.cgi that reference mesh configuration endpoints.
Deploy a network sensor on the management VLAN to identify HTTP traffic to /cgi-bin/cstecgi.cgi originating from client subnets.
Baseline mesh configuration state and alert when parameters drift outside change windows.

Monitoring Recommendations

Monitor wireless client roaming patterns for anomalies consistent with mesh topology tampering.
Track SNMP or syslog output from the router for configuration change events.
Alert on new or unexpected devices joining the mesh, including rogue access points advertising the mesh SSID.

How to Mitigate CVE-2026-51704

Immediate Actions Required

Restrict access to the router's web management interface to a dedicated management network or trusted host list.
Disable Wi-Fi mesh functionality if it is not required in the deployment.
Segregate guest and IoT Wi-Fi networks from the router's management VLAN.
Change any shared administrative credentials on the device as a hygiene measure.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Consult the TOTOLINK Download Page and the TOTOLINK Official Website for firmware updates addressing the setWiFiMeshConfig handler. Apply updated firmware to all TOTOLINK T6 units running 4.1.5cu.748_B20211015 as soon as a fixed release is available.

Workarounds

Place the router behind a firewall that blocks inbound HTTP requests to /cgi-bin/cstecgi.cgi from untrusted client subnets.
Enforce wired-only access to the management interface by disabling HTTP administration over Wi-Fi.
Use Access Control Lists (ACLs) on upstream switches to limit which MAC or IP addresses can reach the router's management IP.
Replace end-of-support consumer routers with hardware that receives regular security updates when patches are unavailable.

bash

# Example firewall rule (upstream Linux gateway) restricting management access
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 80 -s 192.168.100.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 80 -j DROP