CVE-2026-51676

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setAccessDeviceCfg function. An unauthenticated network attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter access-device policies , with potential high impact on both c...

CVE-2026-51721

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) is affected by an incorrect access control flaw in the setPairCfg function. An unauthenticated attacker can alter the mesh pairing state by sending a crafted POST request to /cgi-bin/cstecgi.cgi over the network with no privileges or user interaction ...

CVE-2026-51728

CVE-2026-51728 is an incorrect access control flaw in the UploadFirmwareFile function of the TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ). An unauthenticated, remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to upload a crafted firmware image , potentially leading to full ...

CVE-2026-51740

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51689

TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setUpgradeFW function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to trigger firmware-upgrade workflow changes, rated CVSS 9.1 (CRITICA...

Amazon Linux 2 : libXfont2, --advisory ALAS2-2026-3889 (ALAS-2026-3889)

The version of libXfont2 installed on the remote host is prior to 2.0.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3889 advisory. A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font...

CVE-2026-51704

CVE-2026-51704 is an incorrect access control vulnerability in the setWiFiMeshConfig function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter WiFi mesh configur...

CVE-2026-51680

An incorrect access control vulnerability in the setLedCfg function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to modify LED behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS 3.1 score is 9.1 (Critical) with ...

CVE-2026-51697

An incorrect access control flaw in the setIptvCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker to alter IPTV service configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 9.1 (CRITICAL) , reflectin...

EUVD-2026-68754

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51673

CVE-2026-51673 is an incorrect access control vulnerability in the setNtpCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter the device's time synchronization (NTP) settings , resulti...

Linux Distros Unpatched Vulnerability : CVE-2026-80630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schfqcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever fqcodel drops packets during peek, it calls...

Linux Distros Unpatched Vulnerability : CVE-2026-80599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: dat: ensure accessible ethhdr proto field When batadvgetvid accesses the proto field of the ethernet header, it is not checking if the data itself i...

CVE-2026-51732

An incorrect access control flaw in the delWiFiScheduleCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 5.3 (Medium) with a ne...

EUVD-2026-68674

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51669

Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain pairing and mesh-slave configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51668

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51686

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68511

Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51679

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...