CVE-2026-51718 Overview
CVE-2026-51718 is an incorrect access control vulnerability in the delStaticDhcpRules function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated attackers to remove static DHCP reservations by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The endpoint fails to enforce authentication or authorization checks before processing state-changing requests. The weakness is tracked under [CWE-284: Improper Access Control].
Critical Impact
Remote, unauthenticated attackers can delete static DHCP reservations on affected TOTOLINK T6 devices, disrupting network address assignments and enabling downstream network manipulation.
Affected Products
- TOTOLINK T6 router
- Firmware version 4.1.5cu.748_B20211015
- cstecgi.cgi CGI handler on the device web interface
Discovery Timeline
- 2026-08-31 - CVE-2026-51718 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-51718
Vulnerability Analysis
The vulnerability resides in the delStaticDhcpRules handler exposed through the /cgi-bin/cstecgi.cgi endpoint. The handler processes POST requests intended to remove static DHCP reservations from the router configuration. The function does not validate whether the request originates from an authenticated administrative session. Any attacker capable of reaching the router's management interface can invoke the function directly.
Removing static DHCP reservations disrupts predictable IP assignments for hosts on the local network. Downstream effects can include loss of connectivity for pinned devices, weakened firewall rules that depend on stable IP mappings, and opportunities to reassign freed addresses to attacker-controlled hosts. In network segments where the router's management interface is reachable from the WAN, the impact extends to remote attackers.
Root Cause
The root cause is missing authentication and authorization enforcement inside the delStaticDhcpRules code path. The CGI dispatcher in cstecgi.cgi routes requests to internal handlers based on request parameters, but this specific handler does not check session state before executing the deletion logic. This is a class of access control failure common in embedded router firmware where individual handlers must implement their own session validation.
Attack Vector
An attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with a request body invoking the delStaticDhcpRules action and identifying the target DHCP rule. No credentials, tokens, or session cookies are required. Exploitation requires only network reachability to the device's HTTP interface. See the vendor coordination notes for the disclosure details.
No verified public exploit code is available at this time. Refer to the TOTOLINK firmware download page for firmware status.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-51718
Indicators of Compromise
- Unexpected removal of static DHCP entries in the router configuration or backup files.
- HTTP POST requests to /cgi-bin/cstecgi.cgi referencing delStaticDhcpRules from unauthenticated or unusual source addresses.
- DHCP lease log entries showing previously reserved addresses being reissued to different MAC addresses.
Detection Strategies
- Inspect router access logs for POST requests to /cgi-bin/cstecgi.cgi that contain the delStaticDhcpRules action without a corresponding administrator login event.
- Correlate DHCP configuration changes with authenticated management sessions; unmatched changes indicate abuse.
- Deploy network intrusion detection signatures that match the request pattern targeting the vulnerable CGI endpoint.
Monitoring Recommendations
- Forward router syslog and web-management access logs to a centralized log store for retention and analysis.
- Baseline the set of static DHCP reservations and alert on unexpected deletions.
- Monitor for management-plane traffic originating from WAN interfaces, which should typically be blocked.
How to Mitigate CVE-2026-51718
Immediate Actions Required
- Restrict access to the router's HTTP management interface to trusted LAN segments only and disable WAN-side administration.
- Place TOTOLINK T6 devices behind a network segment that filters inbound traffic to /cgi-bin/cstecgi.cgi.
- Audit current static DHCP reservations and export a known-good configuration backup.
Patch Information
No vendor patch has been referenced in the published CVE data. Check the TOTOLINK official website and the TOTOLINK firmware download page for firmware updates addressing firmware version 4.1.5cu.748_B20211015.
Workarounds
- Block external access to TCP ports serving the router's management interface at the perimeter.
- Apply access control lists that permit management traffic only from designated administrator hosts.
- Consider replacing the device if no vendor fix is released and the network requires WAN-accessible management.
# Example: block inbound WAN access to the router management interface
# Adjust interface names and addresses for your environment
iptables -A INPUT -i wan0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i wan0 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
