CVE-2026-51680

CRITICAL 9.1CVE-2026-51680 · Published 31/08/2026 · updated 31/08/2026

In short

CVE-2026-51680 is a CRITICAL (CVSS 9.1) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.51%, higher than 43.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

References

DarkBoulder/CVE-Vendor-Coordination
ShengWu00/CVE-Vendor-Coordination
totolink.net
totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free