CVE-2026-51715: TOTOLINK T6 Authentication Bypass Flaw

CVE-2026-51715 Overview

CVE-2026-51715 is an incorrect access control vulnerability in the delMacFilterRules function of the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. Unauthenticated remote attackers can send crafted POST requests to /cgi-bin/cstecgi.cgi to remove MAC filter rules without providing valid credentials. The flaw is classified under CWE-284: Improper Access Control and is exploitable over the network with low complexity.

Critical Impact
Unauthenticated attackers can remotely delete MAC filter rules on affected TOTOLINK T6 devices, disabling network access controls and enabling downstream attacks against previously blocked clients.

Affected Products

TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015
Devices exposing the cstecgi.cgi management endpoint to untrusted networks
Deployments relying on MAC filter rules for access control enforcement

Discovery Timeline

2026-08-31 - CVE-2026-51715 published to the National Vulnerability Database
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51715

Vulnerability Analysis

The TOTOLINK T6 exposes a CGI management interface at /cgi-bin/cstecgi.cgi that dispatches requests to internal handler functions based on parameters supplied in the POST body. The delMacFilterRules handler is responsible for removing MAC address filter entries from the router's access control list.

The handler fails to verify that the requester holds an authenticated administrative session before executing the deletion routine. Any actor able to reach the device's HTTP management port can invoke the function directly by crafting a POST request that references the target handler and supplies the identifiers of MAC filter rules to remove.

Removing MAC filter rules disables layer-2 access controls that operators use to block untrusted devices or restrict Wi-Fi access. Once filters are cleared, previously denied endpoints can associate with the network and reach internal hosts, expanding the attack surface for lateral movement and follow-on exploitation.

Root Cause

The root cause is a missing authorization check in the delMacFilterRules code path within cstecgi.cgi. The dispatcher routes the request to the handler without validating a session token or administrator role, violating the principle of complete mediation described by CWE-284.

Attack Vector

Exploitation requires only network reachability to the router's HTTP interface. An attacker sends a crafted POST request to /cgi-bin/cstecgi.cgi referencing the delMacFilterRules topic with parameters identifying the rules to delete. No authentication, user interaction, or prior foothold is required. Devices with WAN-side management exposed are reachable directly from the internet; LAN-side attackers or malicious clients on the same wireless network can exploit the flaw without WAN exposure.

Technical details are documented in the DarkBoulder CVE-Vendor-Coordination repository and the ShengWu00 CVE-Vendor-Coordination repository.

Detection Methods for CVE-2026-51715

Indicators of Compromise

Unexpected HTTP POST requests to /cgi-bin/cstecgi.cgi referencing the delMacFilterRules topic or function name in the request body.
MAC filter rule tables that shrink or empty without a corresponding administrator login event in the router's audit log.
New client associations on the wireless or wired network from MAC addresses that were previously blocked by filter rules.

Detection Strategies

Inspect router access logs and upstream proxies for POST requests to cstecgi.cgi originating from untrusted source IP addresses, particularly outside administrator working hours.
Compare periodic snapshots of the router's MAC filter configuration and alert on unauthorized rule deletions.
Correlate DHCP lease events and 802.11 association logs with the current MAC filter policy to identify clients connecting despite being on the denylist.

Monitoring Recommendations

Forward router syslog and management-plane logs to a centralized SIEM for retention and correlation across network devices.
Baseline normal administrative activity against cstecgi.cgi and alert on request rates or source addresses that deviate from the baseline.
Monitor WAN-side exposure of TCP ports serving the router's HTTP management interface using external attack surface scans.

How to Mitigate CVE-2026-51715

Immediate Actions Required

Restrict access to the router's HTTP management interface to trusted management VLANs and disable WAN-side administration.
Audit current MAC filter rules against the intended policy and restore any entries that have been removed without authorization.
Rotate administrator credentials and review recent configuration changes for signs of tampering.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-51715 at the time of publication. Check the TOTOLINK download page and the TOTOLINK official website for firmware updates addressing the delMacFilterRules handler in the T6 product line. Apply firmware updates as soon as they are released by the vendor.

Workarounds

Place affected TOTOLINK T6 devices behind an upstream firewall that blocks inbound access to the HTTP management port from untrusted networks.
Enforce access control at a higher layer, such as RADIUS-based 802.1X authentication or upstream firewall rules, rather than relying solely on MAC filter rules on the router.
Segment untrusted wireless clients onto an isolated VLAN with no route to sensitive internal resources until firmware remediation is available.

bash

# Example upstream firewall rule to restrict router management access
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 \
  -s <management_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP