Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

TOTOLINK T6 router lets anyone delete MAC filter rules

CVE-2026-51715 · published 2 months ago
Summary

The TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015 does not properly check who is sending a request to remove MAC address filtering rules. An attacker who can reach the router on the network can send a specially crafted request and clear those rules, potentially allowing unauthorized devices to connect. Update the router firmware to the latest version or restrict access to the router’s management interface from trusted networks.

Original advisory text
Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cg...
Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published31 Aug 2026
Updated7 Nov 2026
First seen31 Aug 2026
Sources
CVE-2026-51715 · NVD
CVE-2026-51715 · MITRE
Track software like this
Free during beta