Summary
CVE-2026-51693 is a critical incorrect access control vulnerability (CVSS 9.8) in the setVpnPassCfg function of the TOTOLINK T6 router’s web management interface, firmware version 4.1.5cu.748_B20211015. The endpoint fails to enforce authentication, allowing a remote, unauthenticated attacker to send a crafted POST request that weakens the device’s edge filtering (firewall/VPN passthrough) configuration. This CVE is one of a large batch of similarly structured incorrect-access-control flaws disclosed in the same firmware build, all reachable through the device’s /cgi-bin/cstecgi.cgi CGI handler.
Technical details
- Root cause: The
setVpnPassCfgfunction within/cgi-bin/cstecgi.cgidoes not verify that the requester is an authenticated administrator before applying configuration changes (CWE-284, Improper Access Control). - Trigger conditions: An attacker sends a specially crafted HTTP POST request targeting the
setVpnPassCfgaction on/cgi-bin/cstecgi.cgi; no valid session, credentials, or prior interaction with the device is required. - Attack vector: Network — exploitable remotely over the router’s exposed web management interface, with low attack complexity and no user interaction.
- Impact: Successful exploitation allows an attacker to weaken edge filtering (VPN passthrough/firewall) rules, potentially exposing internal network segments or traffic to further attack. The CVSS vector (C:H/I:H/A:H) reflects a full loss of confidentiality, integrity, and availability for the affected function.
Affected software
- TOTOLINK T6, firmware version 4.1.5cu.748_B20211015
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: No vendor-supplied patched firmware version has been identified for this CVE at time of publication. Check TOTOLINK’s official download page for the T6 model for any newer firmware release and apply it as soon as it becomes available.
- If no patch: Do not expose the TOTOLINK T6 web management interface to the WAN/internet. Restrict access to the management interface to trusted internal networks only, place the device behind a firewall enforcing strict source-based access control, and monitor for unexpected changes to VPN/firewall configuration. Consider retiring or replacing devices running this firmware build if perimeter exposure cannot be eliminated.

