CVE-2026-51720: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51720 Overview

CVE-2026-51720 is an incorrect access control vulnerability in the delIpPortFilterRules function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can remove firewall filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The flaw is categorized under [CWE-284] (Improper Access Control) and requires no authentication or user interaction.

Removing IP and port filter rules disables network-layer protections the administrator configured on the router. This weakens the security posture of the network and can expose internal hosts to inbound traffic that would otherwise be blocked.

Critical Impact
Remote, unauthenticated attackers can delete firewall filter rules on affected TOTOLINK T6 devices, exposing protected internal services to attack.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
The delIpPortFilterRules function exposed through /cgi-bin/cstecgi.cgi

Discovery Timeline

2026-08-31 - CVE-2026-51720 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-51720

Vulnerability Analysis

The TOTOLINK T6 router exposes an HTTP interface through the CGI binary cstecgi.cgi. This binary dispatches requests to internal handler functions based on POST body parameters. The delIpPortFilterRules handler manages deletion of user-configured IP and port firewall filter rules.

The handler does not verify whether the requesting session is authenticated or authorized before removing filter rules. Any client that can reach the device's web management interface can invoke the function directly. Successful requests cause the device to drop firewall entries and reduce the router's ability to block malicious traffic.

The issue affects the confidentiality and integrity of firewall configuration state. Once rules are removed, previously blocked flows become permitted until an administrator restores the configuration.

Root Cause

The root cause is a missing authentication and authorization check in the delIpPortFilterRules code path within cstecgi.cgi. The function trusts input from the HTTP layer without validating session tokens or administrative privileges, matching the [CWE-284] pattern of improper access control on a privileged operation.

Attack Vector

An attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with parameters that invoke the delIpPortFilterRules action. No credentials, cookies, or CSRF tokens are required. The request can originate from the local network or, where the management interface is exposed to the WAN, from the internet.

See the TOTOLINK vendor coordination notes and the companion coordination guide for further technical context. No verified proof-of-concept code has been released at this time.

Detection Methods for CVE-2026-51720

Indicators of Compromise

Unauthenticated POST requests to /cgi-bin/cstecgi.cgi referencing the delIpPortFilterRules topic or action parameter.
Unexpected changes or removals in the router's IP/port filter rule set that do not correlate with administrator activity.
Sudden appearance of previously blocked inbound or outbound network flows through the router.

Detection Strategies

Inspect router web-server access logs for POST requests to cstecgi.cgi that reference filter-rule handlers from non-administrative source addresses.
Correlate firewall rule state snapshots over time and alert on unauthorized deletions.
Deploy network monitoring at egress and internal segmentation points to identify traffic patterns that indicate firewall rules were removed.

Monitoring Recommendations

Enable centralized logging of router management-plane events and forward them to a SIEM or data lake for retention and analysis.
Baseline the expected firewall rule set on each TOTOLINK T6 device and alert on drift.
Monitor for administrative sessions on the router that originate from unexpected geographies or subnets.

How to Mitigate CVE-2026-51720

Immediate Actions Required

Restrict access to the TOTOLINK T6 web management interface to trusted management VLANs and disable WAN-side administration.
Audit configured firewall filter rules and record a known-good baseline for later comparison.
Segment the router away from sensitive internal assets until a vendor fix is available.

Patch Information

No vendor patch has been published in the NVD entry at the time of writing. Check the TOTOLINK official website and the TOTOLINK firmware download portal for firmware updates addressing CVE-2026-51720 on the T6 platform.

Workarounds

Block external access to /cgi-bin/cstecgi.cgi at an upstream firewall or by disabling remote management on the T6.
Place the router behind a network device that enforces authentication and access control lists for management traffic.
Replace affected TOTOLINK T6 devices in high-risk deployments until vendor firmware addressing this issue is available.

bash

# Configuration example: restrict router management access at an upstream firewall
# Allow only the management subnet 10.10.0.0/24 to reach the T6 web UI at 192.0.2.1
iptables -A FORWARD -s 10.10.0.0/24 -d 192.0.2.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.0.2.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.0.2.1 -p tcp --dport 443 -j DROP