CVE-2026-51620

Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51624

Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain a client MAC address via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51614

Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain access-device policy and client state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51616

Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51618

Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51617

Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics...

CVE-2026-51613

Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain device identification details via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51614

Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain access-device policy and client state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51624

CVE-2026-51624 is an incorrect access control vulnerability in the getStationMacByIp function of the TOTOLINK T6 wireless router, firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can obtain a client MAC address by sending a crafted POST request to /cgi-bin/cstecgi.cgi, enablin...

CVE-2026-51625

CVE-2026-51625 is an incorrect access control vulnerability in the getWiFiEasyCfg function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain sensitive Wi-Fi information, including SSIDs...

CVE-2026-51658

CVE-2026-51658 is an incorrect access control vulnerability in the getDmzCfg function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015). Unauthenticated attackers can obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No patch version or workaround is me...

CVE-2026-51653

Incorrect access control in the getStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain storage feature state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67882

Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67877

Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain syslog-related configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67879

Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51655

CVE-2026-51655 affects the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 . An incorrect access control flaw in the getMacFilterRules function allows unauthenticated attackers to obtain MAC filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. This exposes net...

CVE-2026-51653

CVE-2026-51653 is an incorrect access control flaw in the getStorageCfg function of the TOTOLINK T6 router, affecting firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain storage feature state information , represen...

CVE-2026-51651

CVE-2026-51651 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . The vulnerability stems from incorrect access control in the getSmartQosCfg function, accessible via the endpoint /cgi-bin/cstecgi.cgi. An unauthenticated attacker can send a crafted POST request to retrieve Sm...

CVE-2026-51650

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the getRemoteCfg function, reachable via a crafted POST request to /cgi-bin/cstecgi.cgi . The vulnerability allows unauthenticated attackers to retrieve the remote-management enablement ...

CVE-2026-51656

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the getVpnPassCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve VPN pass-through and WAN ping filter settings, exposing networ...