CVE-2026-51681 describes an incorrect access control vulnerability in the setRemoteCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to expose WAN-side administration interfaces by sending a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint. No authentication is required to exploit this vulnerability, making it particularly dangerous for internet-facing devices. The affected product is a consumer/SOHO router manufactured by TOTOLINK. Successful exploitation could allow attackers to enable or reconfigure remote management settings without authorization. This type of vulnerability is common in IoT and home networking equipment where firmware access controls are improperly implemented. References include GitHub-hosted vendor coordination disclosures and the official TOTOLINK website and firmware download page.
