External risk intelligence

TOTOLINK T6 Router Firewall Rule Removal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-51720

The vulnerability affects a TOTOLINK router, a device designed to serve as an internet edge gateway. The management interface or CGI endpoints on such devices are frequently exposed to the public-facing side or are reachable by design to facilitate administration, making them highly likely to be internet-accessible in standard deployment scenarios.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability allows unauthenticated attackers to remove firewall filter rules on TOTOLINK routers by sending a specially crafted request. While the primary concern is confirming relevance and exposure, this could potentially weaken network defenses.

Attackers can remove firewall rules remotely.
Routers control network access; rule removal is a concern.
Confirm if TOTOLINK routers are in use.

Attack Path

How an attacker could exploit the issue

An attacker can remotely remove firewall rules on a TOTOLINK router without needing any credentials. This is possible by sending a specially crafted request to a specific web address on the device. Successfully removing these rules could potentially expose the network to further unauthorized access or disruption.

No authentication required.
Triggered by crafted POST request.
Exposes network to risks.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could remove firewall filter rules on affected devices by sending a specially crafted request to the device's web interface. This could potentially weaken the device's network defenses, allowing for other unauthorized access or network manipulation.

Firewall filter rules.
Crafted POST request to `/cgi-bin/cstecgi.cgi`.
Network access controls weakened.

Operational Fix

Recommended remediation, mitigation, and detection steps

Attackers can bypass access controls to remove firewall rules on TOTOLINK routers. The first step is to identify all deployed TOTOLINK routers, confirm their internet exposure and business criticality, and then identify the accountable owner for remediation planning.

Identify router ownership and exposure.
Verify internet reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK T6 and what is it used for?

The TOTOLINK T6 is a network router designed to act as an internet gateway for home or small business environments. It manages traffic flow between the local network and the internet, providing essential connectivity and security features to protect connected devices and regulate data movement.

What does CWE-284 mean for CVE-2026-51720?

CWE-284 represents a class of vulnerabilities known as Improper Access Control. In the context of this CVE, it means the router fails to properly restrict who is allowed to perform administrative tasks, such as modifying the firewall, allowing unauthorized parties to interact with protected system functions.

How is this firewall vulnerability triggered?

An attacker triggers this flaw by sending a specifically formatted POST request to the device's web management interface at /cgi-bin/cstecgi.cgi. Importantly, this does not require a legitimate user to be logged into the router; it functions even if the attacker has no existing credentials or authorized access.

Why should I care about this CVE based on Halo Surface Signal?

Halo Surface Signal identifies this vulnerability as highly relevant because the affected device serves as an internet edge gateway. Since these devices are often designed to be reachable for administrative purposes, there is a high probability that the vulnerable management endpoint is exposed directly to the public internet.

What are the first steps to take if I run TOTOLINK routers?

Begin by creating an inventory of all TOTOLINK routers in your environment to verify if they are running the affected version. Once identified, determine which units are accessible from the internet, assess their role in your network, and assign an owner to oversee the implementation of security updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.