CVE-2026-51711: TOTOLINK T6 Authentication Bypass Flaw

CVE-2026-51711 Overview

CVE-2026-51711 is an incorrect access control vulnerability in the setWiFiWpsStart function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can trigger a wireless pairing window by sending a crafted HTTP POST request to /cgi-bin/cstecgi.cgi. The flaw enables remote attackers to initiate Wi-Fi Protected Setup (WPS) pairing without any authentication, exposing the wireless network to unauthorized device association. The issue is tracked under CWE-284: Improper Access Control.

Critical Impact
Unauthenticated network-adjacent attackers can force the router into WPS pairing mode, enabling rogue device onboarding and potential lateral movement into the wireless LAN.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
Web management interface endpoint /cgi-bin/cstecgi.cgi

Discovery Timeline

2026-08-31 - CVE-2026-51711 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51711

Vulnerability Analysis

The TOTOLINK T6 exposes an administrative CGI handler at /cgi-bin/cstecgi.cgi that dispatches JSON-encoded actions to internal service functions. The setWiFiWpsStart function initiates a WPS pairing window that allows nearby wireless clients to join the network without providing the pre-shared key. The handler fails to verify that the caller holds an authenticated administrative session before executing the action. Any actor able to reach the router's HTTP interface can therefore start the pairing window remotely.

Root Cause

The root cause is missing access control enforcement on a privileged administrative operation. The cstecgi.cgi dispatcher processes the setWiFiWpsStart action without validating the session token, cookie, or referrer of the incoming POST request. This design flaw maps to CWE-284: Improper Access Control, where a security-relevant function is reachable by unauthenticated clients.

Attack Vector

An attacker sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi with a JSON body invoking the setWiFiWpsStart action. The router responds by opening a WPS pairing window on the wireless radio. During this window, an attacker within radio range, or a colluding client, can associate with the network without knowing the Wi-Fi passphrase. Once associated, the attacker gains a foothold on the LAN segment and can pivot to other internal hosts.

No verified public proof-of-concept code is available. Technical coordination details are published in the CVE Vendor Coordination repository.

Detection Methods for CVE-2026-51711

Indicators of Compromise

Unexpected HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setWiFiWpsStart action from untrusted source addresses.
Router logs showing WPS pairing windows opened outside of authorized administrator activity.
New wireless client associations that occurred during an unscheduled WPS session.

Detection Strategies

Inspect router access logs for POST requests to cstecgi.cgi that reference WPS-related actions and correlate them with authenticated admin sessions.
Monitor wireless client join events and flag associations that occur without a corresponding administrator-initiated pairing.
Alert on any HTTP administrative traffic to the router originating from the WAN interface or from unmanaged LAN hosts.

Monitoring Recommendations

Forward router syslog output to a centralized logging platform and retain WPS state transitions.
Baseline the normal frequency of WPS activation events; investigate deviations promptly.
Track DHCP lease creation for previously unseen MAC addresses on the wireless VLAN.

How to Mitigate CVE-2026-51711

Immediate Actions Required

Disable WPS on the TOTOLINK T6 through the administrative interface until a patched firmware is available.
Restrict management access to the router so that cstecgi.cgi is not reachable from untrusted networks or the WAN.
Segment wireless clients from sensitive internal resources using VLANs and firewall policy.

Patch Information

At the time of publication, no vendor-issued patch is referenced in the NVD advisory. Check the TOTOLINK Download Page for firmware updates addressing CVE-2026-51711 and apply them immediately when released.

Workarounds

Permanently disable the WPS feature on the wireless radio configuration.
Place the router's HTTP administration interface behind an access control list that permits only trusted management hosts.
Rotate the Wi-Fi pre-shared key and audit associated clients after any suspected unauthorized WPS event.