CVE-2026-51723: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51723 Overview

CVE-2026-51723 is an improper access control vulnerability in the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015. The flaw resides in the UploadCustomModule function accessible through the /cgi-bin/cstecgi.cgi endpoint. Unauthenticated attackers can install arbitrary custom CGI modules by sending a crafted HTTP POST request. Successful exploitation grants the attacker code execution capabilities on the device by loading attacker-supplied CGI logic into the router's web server. The vulnerability is classified under CWE-284: Improper Access Control.

Critical Impact
Remote, unauthenticated attackers can install a custom CGI module on affected TOTOLINK T6 routers, enabling arbitrary command execution and full device takeover.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
Devices exposing the /cgi-bin/cstecgi.cgi interface to untrusted networks

Discovery Timeline

2026-08-31 - CVE-2026-51723 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-51723

Vulnerability Analysis

The TOTOLINK T6 web management interface exposes the cstecgi.cgi binary at /cgi-bin/cstecgi.cgi. This CGI handler dispatches requests to internal functions based on parameters in the POST body. One of these handlers, UploadCustomModule, permits clients to upload and register a custom CGI module with the router's web server.

The handler fails to enforce authentication or session validation before processing the upload. Any network-reachable client can invoke the function without credentials. Once a module is installed, it is served by the router and executes with the privileges of the web server process, typically root on consumer-grade TOTOLINK firmware.

This mirrors a pattern seen across TOTOLINK devices in which multiple CGI actions dispatched through cstecgi.cgi lack per-action authorization checks. See the vendor coordination advisory for coordinated disclosure details.

Root Cause

The root cause is missing authorization enforcement in the UploadCustomModule action handler. The dispatcher in cstecgi.cgi routes to the function without verifying that the request originates from an authenticated administrative session. This is a canonical instance of CWE-284: Improper Access Control.

Attack Vector

An attacker sends a single crafted HTTP POST request to /cgi-bin/cstecgi.cgi targeting the UploadCustomModule action. The POST body carries the custom CGI module payload. No credentials, tokens, or user interaction are required. Because many TOTOLINK T6 deployments expose the management interface on the LAN, and some on the WAN, the attack is reachable across local networks and, in misconfigured deployments, directly from the internet.

For technical reproduction steps, refer to the published CVE-Vendor-Coordination repository.

Detection Methods for CVE-2026-51723

Indicators of Compromise

Unexpected POST requests to /cgi-bin/cstecgi.cgi referencing the UploadCustomModule action from unauthenticated sources
New or modified CGI module files in the router filesystem that were not installed by the administrator
Outbound connections from the router to unfamiliar external hosts, indicating a backdoor CGI has been executed
Web server processes on the device spawning unexpected shell commands or network utilities

Detection Strategies

Inspect network traffic to router management interfaces for POST requests to cstecgi.cgi with parameters invoking module upload actions
Alert on any request to /cgi-bin/cstecgi.cgi sourced from the WAN interface
Compare current router firmware and CGI module inventory against a known-good baseline for the T6 model

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized log platform and monitor for anomalous CGI invocations
Monitor DNS and NetFlow telemetry from network segments containing TOTOLINK T6 devices for beaconing patterns
Track administrative interface exposure via periodic external scans of ports 80, 443, and 8080 across managed networks

How to Mitigate CVE-2026-51723

Immediate Actions Required

Remove TOTOLINK T6 management interfaces from WAN exposure and restrict LAN access to trusted administrative hosts
Inventory all TOTOLINK T6 devices running firmware 4.1.5cu.748_B20211015 and prioritize them for replacement or isolation
Reset affected devices to factory defaults and reapply configuration after confirming no custom modules remain installed
Rotate all credentials, pre-shared keys, and Wi-Fi passwords stored on suspected compromised routers

Patch Information

At the time of publication, no vendor patch is referenced in the CVE record. Check the TOTOLINK download page for firmware updates addressing the UploadCustomModule access control flaw. Until a fixed firmware image is released, treat affected devices as vulnerable regardless of local network posture.

Workarounds

Block inbound access to /cgi-bin/cstecgi.cgi at an upstream firewall or router where the T6 sits behind another gateway
Disable remote administration features on the T6 web interface and require VPN access for management
Segment TOTOLINK T6 devices onto an isolated VLAN with strict egress filtering to limit post-exploitation impact
Replace end-of-life or unpatched TOTOLINK T6 units with a supported router model that receives current security updates

bash

# Example upstream firewall rule blocking external access to the vulnerable CGI endpoint
# Adjust interface names and router IP to match your environment
iptables -I FORWARD -p tcp -d 192.168.1.1 --dport 80 \
  -m string --algo bm --string "/cgi-bin/cstecgi.cgi" -j DROP
iptables -I FORWARD -i wan0 -p tcp -d 192.168.1.1 --dport 80 -j DROP