CVE-2026-51706

Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade traffic handling via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51710

Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68647

Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter firewall policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51678

CVE-2026-51678 affects the TOTOLINK T6 router, version 4.1.5cu.748_B20211015 . An incorrect access control flaw in the setSyslogCfg function allows an unauthenticated attacker on the adjacent network to alter the device's logging behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi....

CVE-2026-51684

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51689

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83825

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51672

CVE-2026-51672 is an incorrect access control flaw in the getRoamingCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain the roaming enablement flag, resulting in information ...

CVE-2026-51712

Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter wireless availability windows via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51723

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83833

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWiFiEasyGuestCf function allows unauthenticated attackers to create or weaken guest wireless access. This is achieved by sending a crafted POST request to...

PT-2026-83853

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWiFiGuestCfg function allows unauthenticated attackers to establish or weaken guest wireless access. This is achieved by sending a crafted POST request to...

CVE-2026-51670

TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) contains an incorrect access control flaw in the getSlaveUpdate function. An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to query slave upgrade status and affect upgrade bookkeeping. CISA SSVC rates t...

PT-2026-83875

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68651

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51733

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51734

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51739

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68752

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83836

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWanCfg function allows unauthenticated attackers to alter upstream provisioning and connectivity. This is achieved by sending a crafted POST request to th...