PT-2026-83892

Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51681

An incorrect access control flaw in the setRemoteCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi , thereby exposing the device's WAN-side administration interface. The vulnerability i...

CVE-2026-51693

CVE-2026-51693 is a critical access-control flaw in the setVpnPassCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to weaken the router's edge filtering. The flaw carries a CVSS 3.1 score ...

CVE-2026-51666

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) contains an incorrect access control flaw in the setWizardCfg function. An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to reconfigure WAN, Wi-Fi, and device initialization state , with low i...

PT-2026-83835

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setUpgradeFW function allows unauthenticated attackers to trigger firmware-upgrade workflow changes. This is achieved by sending a crafted POST request to th...

EUVD-2026-68652

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51684

TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setStorageCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter the storage-related service state, with no user interaction requir...

EUVD-2026-68531

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51737

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the clearTracerouteLog function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to erase traceroute logs, enabling concealment of reconnaissance activity. Th...

CVE-2026-51705

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the setWiFiMeshName function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to rename mesh entries , with a CVSS 3.1 score of 9.8 (CRITICAL) reflecting high...

CVE-2026-51709

CVE-2026-51709 is an incorrect access control vulnerability in the setWiFiBasicCfg function of the TOTOLINK T6 router, firmware 4.1.5cu.748_B20211015 . Unauthenticated attackers can reconfigure primary Wi-Fi settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS...

CVE-2026-51699

CVE-2026-51699 is an incorrect access control flaw in the setDmzCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to expose an internal host , effectively bypassing DMZ configuration controls. T...

CVE-2026-51735

An incorrect access control flaw in the showSyslog function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows unauthenticated attackers to retrieve recent system logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 7.5 (High) , reflecting a network-reachable,...

CVE-2026-51739

CVE-2026-51739 affects the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 . The vulnerability is an incorrect access control in the CloudSrvVersionCheck function, which allows unauthenticated attackers to trigger cloud update checks by sending a crafted POST request to /cgi-bin...

EUVD-2026-68580

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51674

CVE-2026-51674 is an incorrect access control flaw in the setScheduleCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated, remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to configure forced reboot tasks , resulting in high impact to...

CVE-2026-51695

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51708

CVE-2026-51708 is a critical (CVSS 9.8) incorrect access control vulnerability in the setWiFiWpsCfg function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated, network-based attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to change WPS availabi...

EUVD-2026-68879

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access...

CVE-2026-51710

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control vulnerability in the setParentalRules function. An unauthenticated attacker on the network can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter parental-control behavior , with high impact t...