CVE-2026-51688

Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service DoS via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51691

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68539

Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68583

Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service DoS via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68588

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83835

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setUpgradeFW function allows unauthenticated attackers to trigger firmware-upgrade workflow changes. This is achieved by sending a crafted POST request to th...

CVE-2026-51725

CVE-2026-51725 is an incorrect access control vulnerability in the NTPSyncWithHost function of TOTOLINK T6 (version 4.1.5cu.748_B20211015). An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to change the device clock, rated CVSS 9.1 (CRITICAL) with high co...

CVE-2026-51727

An incorrect access control vulnerability in the SystemSettings function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to retrieve administrative import and export endpoint information by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CV...

CVE-2026-51725

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51726

Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51728

Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to upload a crafted firmware image via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51729

Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68714

Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68716

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51725

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51718

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 has an incorrect access control flaw in the delStaticDhcpRules function, allowing an unauthenticated attacker to remove static DHCP reservations by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The vulnerability is rated CVSS 9.8 (Critical) wi...

CVE-2026-51719

CVE-2026-51719 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the delUrlFilterRules function allows an unauthenticated attacker to remove URL filtering rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The CVSS v3.1 scor...

CVE-2026-51720

An incorrect access control vulnerability in the delIpPortFilterRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker to delete firewall filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The NVD-assigned CVSS v3.1 score ...

CVE-2026-51722

CVE-2026-51722 affects the TOTOLINK T6 Wi-Fi router (firmware 4.1.5cu.748_B20211015). An incorrect access control flaw in the setWiFiRepeaterCfg function allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi and repoint the device to an attacker-controlled upst...

CVE-2026-51723

CVE-2026-51723 is an incorrect access control vulnerability in the UploadCustomModule function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to install a custom CGI module on the device. The CVSS 3.1 ...