CVE-2026-51620

CVE-2026-51620 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the getNetInfoCfg function allows an unauthenticated, remote attacker to disclose network topology and interface configuration by sending a crafted POST request to /cgi-bin/c...

CVE-2026-51632

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) contains an incorrect access control flaw in the getWiFiAdvancedCfg function. An unauthenticated attacker within the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve advanced wireless settings. The CVSS 3.1 score is...

CVE-2026-51653

CVE-2026-51653 is an incorrect access control flaw in the getStorageCfg function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain storage feature state i...

CVE-2026-51617

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) suffers from incorrect access control in the getSysStatusCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to disclose sensitive data including operation mode, firmware version, serial number, WAN/LAN IP ...

CVE-2026-51649

CVE-2026-51649 affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). The vulnerability is an incorrect access control in the getDiagnosisCfg function, allowing unauthenticated network attackers to retrieve diagnostic configuration and ping log contents by sending a crafted POST reques...

CVE-2026-51615

Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51663

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) is affected by an incorrect access control flaw in the getWiFiApcliScan function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to trigger wireless scans and retrieve AP-client scan results , exposing client inform...

EUVD-2026-67899

Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67906

Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67891

Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67892

Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain advanced wireless settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67876

Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67877

Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain syslog-related configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67878

Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67879

Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67882

Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51624

CVE-2026-51624 is an incorrect access control flaw in the getStationMacByIp function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve a connected client's MAC address , enabling netwo...

PT-2026-83121

Name of the Vulnerable Software and Affected Versions CP Plus CP-XR-DE21-S affected versions not specified Description The CP Plus CP-XR-DE21-S Router contains hardcoded HTTP Digest authentication credentials within its firmware. These credentials are identical across all devices running the...

PT-2026-83361

Name of the Vulnerable Software and Affected Versions mongosqld affected versions not specified Description When configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one. This allows clients that provide no...

CVE-2026-51617

Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics...