CVE-2026-51674 in TOTOLINK
Summary
by MITRE • 08/31/2026
Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in the setScheduleCfg function of TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015 represents a critical failure in access control mechanisms, specifically classified under CWE-284 Improper Access Control. This flaw allows unauthenticated remote attackers to execute administrative functions that should be restricted to authorized users with valid credentials. The core technical issue lies within the handling of HTTP POST requests directed at the /cgi-bin/cstecgi.cgi endpoint, where the system fails to verify the authentication status or session validity before processing configuration changes related to scheduled tasks.
By exploiting this misconfiguration, an attacker can send a crafted POST request containing specific parameters designed to trigger forced reboot operations without needing to log in first. This capability effectively bypasses the intended security boundaries of the device's web interface, granting external actors the ability to manipulate system behavior at will. The absence of proper authentication checks for such sensitive operational commands highlights a significant gap in the implementation of secure coding practices and input validation protocols within the router's firmware architecture.
The operational impact of this vulnerability is substantial, primarily centering on service availability and potential denial-of-service conditions. An attacker can repeatedly trigger forced reboots to disrupt network connectivity for all devices connected to the TOTOLINK T6 router. This persistent disruption can lead to significant downtime in home or small business networks, affecting productivity and communication reliability. Furthermore, frequent unauthorized reboots may contribute to hardware wear over time, although the primary concern remains the immediate loss of service availability caused by the maliciously induced restarts.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK techniques related to resource hijacking or disruption, as it allows an adversary to degrade system performance and reliability through unauthorized control mechanisms. The ability to execute administrative commands without authentication is particularly dangerous in IoT environments where devices often serve as gateways for broader network segments, potentially exposing other connected systems to secondary risks if the reboot cycles cause instability in dependent services.
Mitigation strategies should prioritize immediate firmware updates provided by TOTOLINK that address this specific access control flaw. Administrators must ensure their routers are running patched versions of the 4.1.5cu series or later releases where proper authentication checks have been implemented for all administrative endpoints, including /cgi-bin/cstecgi.cgi. In cases where updating is not immediately feasible, restricting physical and remote network access to the router's management interface via firewall rules can provide a temporary layer of defense against unauthenticated exploitation attempts until a permanent software fix is applied.