External risk intelligence

TOTOLINK T6 WPS PIN Generation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-51628

The vulnerability resides in a wireless router's web-based management interface. Such devices are commonly deployed as edge gateways, and management interfaces are frequently exposed to the public internet, either intentionally for remote administration or unintentionally due to default configurations.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in TOTOLINK wireless routers that allows unauthenticated attackers to generate new security PINs. The issue lies in the device's access control for a function that handles Wi-Fi Protected Setup (WPS) PIN generation. If exploited, an attacker could potentially gain unauthorized access to the network by creating and retrieving a new WPS PIN. The main concern is confirming relevance and exposure to our environment.

Unauthenticated access to generate network security PINs.
Could allow unauthorized network entry.
Confirm relevance and exposure to our environment.

Attack Path

How an attacker could exploit the issue

An attacker can remotely access a vulnerable router's administration interface without needing any credentials. By sending a specially crafted request to a specific program on the router, the attacker can cause it to generate and reveal a new Wi-Fi Protected Setup (WPS) PIN. This allows the attacker to potentially gain unauthorized access to the device's network.

Entry: Network access to the router.
Trigger: Sending a crafted POST request.
Risk: Unauthorized network access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to generate and retrieve a new Wi-Fi Protected Setup (WPS) PIN. This could potentially expose sensitive Wi-Fi network credentials when supported by the advisory.

Wi-Fi PIN and network access at risk.
Crafted POST request to router interface.
Unauthorized access to Wi-Fi network.

Operational Fix

Recommended remediation, mitigation, and detection steps

Infrastructure and network teams are likely responsible for managing and securing the TOTOLINK T6 devices. The immediate first step should be to identify all deployed instances of this hardware, confirm their internet reachability and business criticality, and then assign ownership for remediation.

Infrastructure/Network teams own remediation.
Verify internet exposure and criticality first.
Plan maintenance for vendor-supported fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK T6 router?

The TOTOLINK T6 is a wireless networking device used to provide home or office Wi-Fi connectivity. It acts as an edge gateway, managing traffic between the local network and the internet. The device includes a web-based administration interface that allows users to configure settings like Wi-Fi security features, including the Wi-Fi Protected Setup (WPS) function.

What does CVE-2026-51628 mean for security?

This vulnerability is an Improper Access Control issue, categorized as CWE-284. It means the router fails to verify if a user has permission to perform specific administrative tasks. In this case, the weakness allows anyone to interact with a function designed to generate Wi-Fi Protected Setup PINs, bypassing the security controls that should normally protect such sensitive operations.

How is this WPS PIN vulnerability triggered?

An attacker triggers the vulnerability by sending a specifically crafted POST request to a designated file on the router's web interface. It is important to note that the attacker does not need to provide any credentials or be logged into the device to succeed; however, they must have network connectivity to the management interface for the request to reach the device.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, this vulnerability is likely relevant if your router is used as an edge gateway. Because these devices are often deployed at the network perimeter, their management interfaces are frequently exposed to the internet, either through intentional remote administration settings or by default configurations that remain accessible to the public.

What should I do if I use TOTOLINK T6 routers?

Your first step is to locate all TOTOLINK T6 devices in your environment to understand your footprint. Once identified, evaluate whether the management interface is reachable from the internet or restricted to your internal network. You should then coordinate with your network team to confirm if vendor-supplied updates or configuration changes are available to secure the device.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.