EUVD-2026-68005

Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51665

TOTOLINK T6 router, running firmware 4.1.5cu.748_B20211015 , has an incorrect access control flaw in the getTracerouteCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain traceroute diagnostic logs , which may reveal internal network path inf...