External risk intelligence

TOTOLINK T6 Router Unauthenticated DHCP Reservation Removal

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-51718

The vulnerability exists in a home/small office router product. These devices are commonly deployed at the network edge, and the vulnerable function is reachable via a web management interface, which is frequently exposed to the internet or accessible from the WAN side in many default or common residential configurations.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in TOTOLINK routers could allow unauthenticated attackers to remove network configuration settings by sending a specially crafted request. This issue is particularly concerning given the common deployment of these devices at the network edge, potentially exposing them to external threats.

Attackers can delete network settings remotely.
Routers at the network edge are potentially exposed.
Confirm product relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can remove static DHCP reservations by sending a specially crafted request to the device's web interface. This function is exposed externally and accessible without any authentication, potentially allowing an attacker to disrupt network configurations.

No authentication required to access.
Triggered by a crafted POST request.
Leads to denial of service or configuration manipulation.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could remove static DHCP reservations, potentially disrupting network connectivity for devices. This could affect the network's ability to assign IP addresses to devices when supported by the advisory's provided context.

Network device configurations at risk.
Via crafted POST request to router.
Network disruption and client connectivity issues.

Operational Fix

Recommended remediation, mitigation, and detection steps

In a real-world scenario, owners of TOTOLINK devices, likely within small office or home environments, are responsible for addressing this critical vulnerability. The first practical step is to identify all instances of the affected router, determine if its management interface is exposed externally or reachable from the WAN, and then confirm the specific owner responsible for its management. This will inform the remediation plan, which may involve vendor coordination or configuration changes to reduce risk.

Device owners should manage this vulnerability.
Verify external reachability of the management interface.
Coordinate with the vendor for a fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK T6 router?

The TOTOLINK T6 is a networking device typically used in home and small office environments to manage internet connectivity and local network traffic. It acts as a gateway that assigns IP addresses to connected devices through DHCP, ensuring they can communicate within the network and access the internet.

What is the vulnerability in CVE-2026-51718?

This vulnerability is an Improper Access Control issue, classified as CWE-284. It means the router fails to verify whether a user is authorized to perform specific administrative tasks. In this case, the device allows anyone to invoke a function that deletes saved network settings without checking for login credentials.

How is this vulnerability triggered?

The bug is triggered when an attacker sends a specifically formatted POST request to the router's web management interface at the path /cgi-bin/cstecgi.cgi. Importantly, normal browsing or standard network usage will not trigger this; the request must specifically target the delStaticDhcpRules function to remove reservations.

Do I need to worry if my TOTOLINK T6 is on the internal network?

According to Halo Surface Signal, you should be concerned if your management interface is reachable from the WAN or exposed to the internet. While internal-only access reduces the immediate risk from external actors, these devices are often deployed at the network edge, making unauthorized configuration changes a significant concern.

What should I do to address CVE-2026-51718?

Start by identifying all TOTOLINK T6 routers in your environment and checking if their management interfaces are accessible from the internet. If you find one, verify who manages the device and look for guidance from the vendor. Limiting interface access to local connections is a helpful initial step to reduce risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.