External risk intelligence

TOTOLINK T6 Improper Access Control Allows Unauthenticated QoS Rule Removal

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-51724

This vulnerability affects a home/small office router device via a web management interface. These devices are designed to act as internet edge gateways, and their management interfaces are frequently exposed to the public internet or are reachable by default as part of their standard deployment pattern.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves improper access controls in a specific function within TOTOLINK routers, potentially allowing unauthenticated attackers to remove Quality of Service (QoS) rules. The concern is that unauthorized modification of QoS settings could disrupt network traffic management for affected devices. The primary concern at this time is confirming if this specific technology is in use within your environment.

Attackers can remove network traffic rules.
Unauthenticated access to network control.
Confirm if this router technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker can target the TOTOLINK T6 router without needing any credentials. By sending a specially crafted request to the device's web interface, they can trigger a function that improperly handles access, allowing them to delete Quality of Service rules. This could potentially disrupt network performance or allow for other unauthorized modifications.

No authentication required for access.
Triggered by a POST request to a specific endpoint.
Allows removal of network configuration rules.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to remove Quality of Service (QoS) rules from a TOTOLINK router. This could impact network performance and traffic prioritization when supported by the advisory.

Network traffic prioritization rules.
Crafted POST request to the router.
Disruption of network performance.

Operational Fix

Recommended remediation, mitigation, and detection steps

Owners of TOTOLINK devices, typically consumer or small-office network infrastructure, should lead the initial response. The immediate priority is to identify all instances of the affected technology, confirm their exposure and criticality, and then assign an accountable owner for remediation. This may involve coordination with the device vendor if direct fixes are not available.

Assign device and network owners.
Verify device accessibility and criticality.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK T6 router?

The TOTOLINK T6 is a network device typically used in homes or small offices to provide internet connectivity. It functions as a gateway that manages traffic flow and security for connected devices. These routers feature a web-based management interface, which allows administrators to configure various network settings, including Quality of Service (QoS) rules that prioritize specific types of data traffic.

What does CVE-2026-51724 mean for security?

This vulnerability is classified as an improper access control issue, known technically as CWE-284. It means the software fails to verify if a user has the proper authority before executing a command. Specifically in this CVE, the device's management software does not require any credentials to process requests to remove network traffic rules, allowing an unauthorized person to change settings that should be restricted to the administrator.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically formatted POST request to the device's web management interface. This request targets the internal function responsible for handling Quality of Service configurations. It is important to note that simply visiting the router's webpage or loading an image from it will not trigger this behavior; the request must be crafted to interact directly with the specific cstecgi.cgi endpoint.

Is my TOTOLINK T6 device at risk?

According to Halo Surface Signal, this vulnerability is highly relevant because TOTOLINK T6 routers act as internet edge gateways. Because their management interfaces are frequently exposed to the public internet or are reachable by default in standard setups, the device is considered 'external' and potentially accessible to anyone on the internet, increasing the likelihood that a remote attacker could interact with the affected function.

What should I do if I use this router?

Your first step is to verify if you have this specific model and firmware version running in your environment. Once identified, restrict access to the device's management interface so it is not reachable from the public internet. Since this is an access control issue, you should monitor official vendor channels for security updates or guidance on how to secure your configuration until a patch is available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.