Security readout for executives and security teams
Plain-English summary
A flaw in the TOTOLINK T6 router can let an unauthenticated network attacker activate its wireless pairing window. This may create an opportunity for unauthorized wireless access, putting traffic and connected systems at risk. The supplied evidence identifies firmware 4.1.5cu.748_B20211015 only.
Executive priority
Prioritize identification and containment immediately because exploitation needs no credentials and could undermine network trust. Absence from KEV lowers evidence of current widespread attacks, but it does not reduce the underlying technical severity. Require confirmation of exposure and vendor-supported remediation.
Technical view
CVE-2026-51711 is an incorrect access-control issue (CWE-284) in setWiFiWpsStart. An unauthenticated attacker can send a crafted network request to the router’s CGI management endpoint and start WPS pairing. CVSS 3.1 scores it 9.1: network-accessible, low complexity, no privileges or user interaction, with high confidentiality and integrity impact.
Likely exposure
Exposure is supported for TOTOLINK T6 devices running firmware 4.1.5cu.748_B20211015. Risk is greatest where the management endpoint is reachable from untrusted networks. The supplied affected-product metadata is incomplete, and there is no evidence that other models or firmware versions are vulnerable.
Exploitation context
The technique requires network reachability but no authentication or user interaction. The supplied bundle does not report confirmed exploitation, and the CVE is not identified as being in KEV. Public coordination references alone do not establish active attacks.
Researcher notes
The record identifies the vulnerable function, endpoint, firmware, CWE-284, and CVSS vector. Evidence is incomplete regarding additional affected releases, patch availability, detection artifacts, and real-world exploitation. Validate only within authorized environments and avoid assuming the CVSS confidentiality and integrity impacts prove successful pairing in every configuration.
Mitigation direction
- Inventory TOTOLINK T6 devices and identify those running the stated firmware.
- Restrict router management access to trusted administrative networks.
- Disable WPS where operationally feasible until vendor remediation is confirmed.
- Check TOTOLINK guidance and download pages for an applicable fixed firmware.
- Replace or isolate affected devices if no supported remediation is available.
Validation and detection
- Confirm each device model and installed firmware through trusted administrative records.
- Verify management interfaces are not reachable from internet or guest networks.
- Confirm WPS is disabled where business requirements permit.
- Review TOTOLINK guidance for firmware explicitly applicable to the T6.
- After remediation, verify firmware versions and management-access restrictions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-51711 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.htmlCVE reference, mitre
- https://www.totolink.net/CVE reference, mitre
- https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.mdCVE reference, mitre
- https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.mdCVE-2026-51711CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE mapping pending import
This CVE carries a CWE mapping that will resolve to a full Glexia CWE intelligence page after the official CWE import is complete.