TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38401)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the clearTracerouteLog function. Attackers can exploit this vulnerability by sending a specially crafted...

CVE-2026-51737

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51737

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51737

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an improper access control flaw in the clearTracerouteLog function. This allows unauthenticated attackers to erase traceroute logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoin...

EUVD-2026-68749

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51737: Improper Access Control

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68005

Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51665

Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83342

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the getTracerouteCfg function allows unauthenticated attackers to obtain traceroute diagnostic logs. This is achieved by sending a crafted POST request to the...

CVE-2026-51665

Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51665

Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51665

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control vulnerability in the getTracerouteCfg function. This flaw allows unauthenticated attackers to obtain traceroute diagnostic logs by sending a crafted POST request to the /cgi-bin/cstecg...