CVE-2026-51721

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51670

Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to query slave upgrade status and affect upgrade bookkeeping via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51668

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51668

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is susceptible to an improper access control vulnerability in the setLanguageCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint t...

CVE-2026-51670

The TOTOLINK T6 wireless dual-band Mesh router is vulnerable to an improper access control flaw in the getSlaveUpdate function within version 4.1.5cu.748_B20211015 . An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi. This allows the attacker to...

CVE-2026-51671

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51674

The TOTOLINK T6 dual-band wireless Mesh router is vulnerable to an improper access control flaw in the setScheduleCfg function. This vulnerability affects version 4.1.5cu.748_B20211015 and allows unauthenticated attackers to configure forced reboot tasks by sending a crafted POST request to the /...

CVE-2026-51675

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51675

The TOTOLINK T6 wireless dual-band Mesh router (specifically version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setWanIeCfg function. This vulnerability allows unauthenticated attackers to reconfigure uplink settings by sending a specially crafted POST reques...

CVE-2026-51680

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51681

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51679

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51678

Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51679

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an improper access control flaw within the setPasswordCfg function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoi...

CVE-2026-51678

The TOTOLINK T6 wireless dual-band Mesh router, specifically running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an improper access control flaw. The root cause is located in the setSyslogCfg function, which fails to properly authenticate requests. This allows unauthenticated attack...

CVE-2026-51681

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability within the setRemoteCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Succes...

CVE-2026-51680

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setLedCfg function. This allows unauthenticated attackers to modify the device's LED behavior by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Exploitation det...

PT-2026-83804

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWizardCfg function allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state. This is achieved by sending a crafted POST...

CVE-2026-51690

Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51689

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi...