CVE-2026-82616

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public a...

CVE-2026-82616 TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public a...

CVE-2026-82616 TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public a...

EUVD-2026-68353

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public a...

CVE-2026-82616

A stack-based buffer overflow in the setUploadSetting function of /cgi-bin/cstecgi.cgi affects TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 . The flaw is triggered by manipulating the FileName argument, allowing a remote attacker with low privileges to overflow the stack and potentially gain c...

CVE-2026-82597

A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-82597 TOTOLINK NR1800X cstecgi.cgi setUssd command injection

A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-82597

A command injection vulnerability exists in TOTOLINK NR1800X (version 9.1.0u.6681_B20230703), specifically in the setUssd function of /cgi-bin/cstecgi.cgi . Manipulating the ussd argument allows a remote attacker with low privileges to inject arbitrary commands. The attack requires no user intera...

CVE-2026-51723

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51708

Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68544

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68512

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68592

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83960

Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68676

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83862

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setMacFilterRules function allows unauthenticated attackers to modify device access control. This is achieved by sending a specially crafted POST request to...

PT-2026-83825

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51711

Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51671

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51708

Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi...