Summary
CVE-2026-51738 is an improper access control vulnerability (CWE-284) in the LoadDefSettings function of TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015. An unauthenticated remote attacker can send a crafted POST request to the device’s CGI interface to force a factory reset and reboot of the router. The flaw carries a CVSS v3.1 base score of 9.8 (Critical).
Technical details
- Root cause: the
LoadDefSettingsfunction, reachable through the router’s/cgi-bin/cstecgi.cgiendpoint, does not enforce authentication or authorization before executing. - Trigger condition: sending a specially crafted POST request to
/cgi-bin/cstecgi.cgithat invokes theLoadDefSettingsaction. - Attack vector: Network — no credentials or user interaction are required (PR:N, UI:N).
- Impact: the device is reset to factory default configuration and rebooted, resulting in loss of configuration integrity and availability (denial of service); rated High for confidentiality, integrity, and availability impact.
Affected software
- TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: No official vendor patch or security advisory has been published for this specific CVE at this time. Check TOTOLINK’s official support/download page for a firmware update addressing this issue and apply it as soon as it becomes available.
- If no patch: Restrict access to the router’s management/CGI interface (
/cgi-bin/cstecgi.cgi) to trusted internal networks only; disable remote/WAN-side administration; place the device behind a firewall or VPN so it is not directly internet-exposed; monitor for unexpected configuration resets or reboots as a possible indicator of exploitation attempts.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Raw response body:
/cgi-bin/cstecgi.cgi - Page title:
TOTOLINK

