CVE-2026-51726

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the delParentalRules function. An unauthenticated attacker can remove parental-control rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi....

CVE-2026-51696

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the setPortForwardRules function. This vulnerability allows unauthenticated attackers to expose internal services by sending a crafted POST request to the /cgi-bin/cstecgi.cg...

CVE-2026-51717

The TOTOLINK T6 wireless dual-band Mesh router is vulnerable to an improper access control flaw in the setOpModeCfg function. This vulnerability allows unauthenticated attackers to change the device's operating mode by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint....

PT-2026-83853

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWiFiGuestCfg function allows unauthenticated attackers to establish or weaken guest wireless access. This is achieved by sending a crafted POST request to...

EUVD-2026-68585

Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83852

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setUploadSetting function allows unauthenticated attackers to manipulate the upload or flash workflow. This is achieved by sending a crafted POST request to...

PT-2026-83888

Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter roaming behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83871

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83861

Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51706

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setSmartQosCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi , which allows for the degradati...

CVE-2026-51713

The TOTOLINK T6 wireless dual-band Mesh router is vulnerable to an incorrect access control flaw in the setManualDialCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi , allowing them to manipulate the WAN dial state . This issue a...

EUVD-2026-68586

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51678

The TOTOLINK T6 wireless dual-band Mesh router, specifically running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an improper access control flaw. The root cause is located in the setSyslogCfg function, which fails to properly authenticate requests. This allows unauthenticated attack...

CVE-2026-51712

The TOTOLINK T6 wireless dual-band Mesh router is affected by a vulnerability in the setApWiFiSchCfg function. Due to improper access control , an unauthenticated attacker can alter wireless availability windows by sending a crafted POST request to /cgi-bin/cstecgi.cgi. This issue specifically im...

CVE-2026-51733

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the FirmwareUpgrade() function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which...

CVE-2026-51690

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to improper access control within the setWanCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. This allows the attacker to ...

CVE-2026-51729

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an improper access control flaw in the delDevice function. This vulnerability allows unauthenticated attackers to delete managed slave devices by sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51736

The TOTOLINK T6 wireless dual-band Mesh router is vulnerable to an incorrect access control flaw in the clearSyslog function. Unauthenticated attackers can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi to erase system logs . This vulnerability affects the 4.1.5cu.748_B202...

CVE-2026-51689

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51695

The TOTOLINK T6 wireless dual-band Mesh router (specifically version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setDdnsCfg function. This vulnerability allows unauthenticated attackers to alter the dynamic DNS state by sending a specially crafted POST request...