CVE-2026-51722 Overview
CVE-2026-51722 is an incorrect access control vulnerability [CWE-284] in the setWiFiRepeaterCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to reconfigure the router's Wi-Fi repeater settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Successful exploitation lets an attacker repoint the device to an attacker-controlled upstream Wi-Fi network, enabling traffic interception and manipulation for all downstream clients.
Critical Impact
Unauthenticated attackers on the network can hijack the router's upstream Wi-Fi connection, exposing all client traffic to man-in-the-middle attacks.
Affected Products
- TOTOLINK T6 router
- Firmware version 4.1.5cu.748_B20211015
- Devices exposing the /cgi-bin/cstecgi.cgi management endpoint
Discovery Timeline
- 2026-08-31 - CVE-2026-51722 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-51722
Vulnerability Analysis
The TOTOLINK T6 router exposes a CGI management interface at /cgi-bin/cstecgi.cgi that dispatches configuration requests to internal handler functions. The setWiFiRepeaterCfg handler is responsible for configuring the device's Wi-Fi repeater mode, including the upstream SSID and pre-shared key used to bridge external wireless networks. This handler processes POST requests without validating that the caller holds an authenticated administrative session.
An attacker within reach of the device's LAN or Wi-Fi interface can invoke the handler directly. By supplying attacker-chosen SSID and credential parameters, the attacker forces the router to associate with a rogue upstream access point. All client traffic subsequently flows through infrastructure controlled by the attacker.
Root Cause
The root cause is missing authentication and authorization enforcement on a privileged CGI action [CWE-284]. The cstecgi.cgi dispatcher accepts the setWiFiRepeaterCfg topic from unauthenticated sources instead of requiring a valid session cookie or administrative token before applying configuration changes.
Attack Vector
Exploitation requires network access to the router's HTTP management service and a single crafted POST request to /cgi-bin/cstecgi.cgi. No credentials, user interaction, or prior compromise are required. The request specifies the setWiFiRepeaterCfg action along with the target upstream SSID and passphrase controlled by the attacker.
Once the router reconnects to the rogue upstream, the attacker can inspect plaintext protocols, strip TLS via captive-portal tricks, inject malicious responses, and pivot to internal hosts. Additional technical detail is available in the CVE Coordination Resource on GitHub.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-51722
Indicators of Compromise
- Unexpected changes to the router's repeater configuration or upstream SSID in the administrative UI.
- HTTP POST requests to /cgi-bin/cstecgi.cgi referencing the setWiFiRepeaterCfg topic from unauthenticated sources.
- Router logs showing repeater re-association to an SSID that does not match the environment's approved networks.
- Sudden loss of internet connectivity followed by DNS resolutions to unfamiliar resolvers on client devices.
Detection Strategies
- Monitor router administrative interfaces for POST requests to cstecgi.cgi originating from clients without an active admin session.
- Alert on configuration events that modify the upstream Wi-Fi SSID, BSSID, or PSK outside of change windows.
- Correlate client MAC-to-gateway ARP changes with sudden upstream SSID transitions on affected TOTOLINK T6 devices.
Monitoring Recommendations
- Forward router syslog to a centralized log platform and retain configuration-change events for review.
- Baseline the expected upstream SSID and BSSID for each TOTOLINK T6 device and alert on deviations.
- Inspect wireless spectrum for rogue access points advertising SSIDs matching legitimate corporate networks.
How to Mitigate CVE-2026-51722
Immediate Actions Required
- Restrict access to the router's HTTP management interface to trusted management VLANs only.
- Disable Wi-Fi repeater mode on TOTOLINK T6 devices where it is not required.
- Isolate affected devices from untrusted network segments until a vendor fix is applied.
- Rotate any credentials or secrets that may have traversed the router while exploitation was possible.
Patch Information
No vendor patch is referenced in the current CVE record. Administrators should monitor the TOTOLINK Firmware Download Page and the TOTOLINK Official Website for firmware updates addressing the setWiFiRepeaterCfg access control flaw.
Workarounds
- Place the TOTOLINK T6 behind a firewall that blocks inbound access to /cgi-bin/cstecgi.cgi from client networks.
- Enforce WPA2/WPA3 with strong PSKs on all connected Wi-Fi networks and monitor for rogue SSIDs.
- Replace end-of-life or unpatched TOTOLINK T6 units with supported hardware where firmware fixes are unavailable.
- Require VPN or TLS for all sensitive client traffic to reduce the impact of an upstream Wi-Fi hijack.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
