CVE-2026-51711 in TOTOLINK
Summary
by MITRE • 08/31/2026
Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in the TOTOLINK T6 router, specifically within firmware version 4.1.5cu.748_B20211015, represents a critical failure in access control mechanisms governing wireless configuration functions. The core technical flaw resides in the setWiFiWpsStart function, which is designed to initiate Wi-Fi Protected Setup (WPS) pairing processes. Under normal operational conditions, this administrative action should require valid authentication credentials from an authorized user who has logged into the router's management interface. However, due to insufficient validation of session tokens or access privileges within the CGI script handling POST requests at /cgi-bin/cstecgi.cgi, the system fails to verify whether the requester is authenticated before executing the command. This oversight allows unauthenticated external actors to bypass security controls entirely by sending a specifically crafted HTTP POST request directly to this endpoint.
From an operational perspective, the ability for an attacker to trigger WPS pairing without authentication poses significant risks to network integrity and confidentiality. Wi-Fi Protected Setup was originally intended as a convenience feature to simplify device connection but has historically been plagued by design weaknesses, particularly regarding its PIN-based verification method which is susceptible to brute-force attacks. By forcing the router into a state where it accepts wireless pairing requests from unknown sources, an attacker can potentially exploit these inherent WPS vulnerabilities to recover the network's pre-shared key or establish unauthorized connections. This effectively compromises the confidentiality of encrypted traffic and allows malicious actors to join the local area network without possessing valid credentials, thereby gaining potential access to internal resources, IoT devices, and sensitive data transmitted over the wireless medium.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as the software does not properly restrict actions for unauthorized users. Furthermore, it maps to MITRE ATT&CK technique T1530, Data from Information Repositories, in contexts where an attacker might use this access to exfiltrate network configuration details or credentials stored on the device. The exploitation vector is classified under Network-Based Attack with Low Complexity because it requires no prior authentication and can be executed remotely over standard HTTP protocols commonly exposed by router management interfaces.
Mitigation strategies for this vulnerability primarily involve immediate firmware updates provided by TOTOLINK that patch the access control logic in the setWiFiWpsStart function to enforce strict authentication checks before processing WPS requests. In environments where updating is not immediately feasible, administrators should disable the WPS feature entirely through available configuration options if possible, thereby removing the attack surface associated with this specific functionality. Additionally, restricting management interface access to trusted IP addresses via firewall rules and ensuring that default administrative passwords are changed can reduce the likelihood of exploitation by limiting exposure to untrusted networks or brute-force attempts on other authentication vectors.