CVE-2026-51701

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015

Description Incorrect access control in the setMacFilterRules() function allows unauthenticated attackers to modify device access control. This is achieved by sending a specially crafted POST request to the '/cgi-bin/cstecgi.cgi' endpoint.

Recommendations As a temporary workaround, restrict access to the '/cgi-bin/cstecgi.cgi' endpoint or disable the setMacFilterRules() function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.