CVE-2026-51629
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 allows unauthenticated attackers to obtain static DHCP reservation rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
Risk Assessment
Disclosure of static DHCP reservations could help an attacker map the network and conduct man-in-the-middle attacks.
Recommendation
Update the router firmware and enable authentication for all requests to the CGI interface.
Other vulnerabilities in TOTOLINK T6
See all- CVE-2026-51770Critical
Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51769Critical
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51767Critical
Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51765Critical
Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51764Critical
Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51763Critical
Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51762Critical
Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51760Critical
Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51757Critical
Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the cs_broker component.
- CVE-2026-51754Critical
Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the cs_broker component.
Original NVD description (English source)
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS