Description
Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Published: 2026-08-31
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized removal of Wi‑Fi ACL rules
Action: Update Firmware
AI Analysis

Impact

The delWiFiAclRules function in TOTOLINK T6 firmware accepts a crafted POST request to /cgi-bin/cstecgi.cgi without requiring authentication. A malicious actor can therefore delete Wi‑Fi access‑control list entries, potentially allowing unauthorized devices to connect or causing a denial of service by clearing legitimate rules. This flaw is an improper access‑control failure that directly affects network integrity and availability.

Affected Systems

The vulnerability affects TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015. No additional affected versions are specified in the available data.

Risk and Exploitability

The CVSS score of 9.1 indicates high severity, and the lack of authentication requirement allows any network‑connected actor to trigger the removal of ACL rules by sending a crafted POST payload to the web interface. The EPSS score is not available and the flaw is not listed in CISA KEV, suggesting limited early exploitation activity, but the high impact and straightforward attack path present a significant threat to network security.

Generated by OpenCVE AI on August 31, 2026 at 22:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest TOTOLINK T6 firmware that includes a fix for the delWiFiAclRules function.
  • Restrict access to the /cgi-bin/cstecgi.cgi endpoint to trusted management IP addresses only.
  • Enable or enforce authentication on the router’s web management interface and consider disabling the delWiFiAclRules endpoint if it is not required.

Generated by OpenCVE AI on August 31, 2026 at 22:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Removal of Wi‑Fi ACL Rules via POST Request

Mon, 31 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Removal of Wi‑Fi ACL Rules via POST Request
First Time appeared Totolink
Totolink t6
Weaknesses CWE-284
Vendors & Products Totolink
Totolink t6

Mon, 31 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Description Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References

Subscriptions

Totolink T6
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-31T19:00:31.670Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51730

cve-icon Vulnrichment

Updated: 2026-08-31T19:00:28.037Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T18:17:18.770

Modified: 2026-08-31T20:59:32.817

Link: CVE-2026-51730

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T22:15:04Z

Weaknesses