EUVD-2026-68634

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68636

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83890

Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51717

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68678

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83875

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51713

CVE-2026-51713 affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An incorrect access control flaw in the setManualDialCfg function allows unauthenticated attackers to manipulate the WAN dial state by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The CVSS 3.1 score is 9....

CVE-2026-51740

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the killProcess function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to terminate critical services on the device. The vulnerability is scored CVSS 9.8 (Critical)...

EUVD-2026-68711

Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51733

CVE-2026-51733 is an incorrect access control vulnerability in the FirmwareUpgrade function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to remove Wi-Fi schedule entries. The root cause is in...

CVE-2026-51706

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the setSmartQosCfg function. An unauthenticated attacker on an adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to degrade traffic handling , resulting in a low a...

CVE-2026-51706

Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade traffic handling via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68651

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68649

Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83990

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.9.4 Description An authentication bypass exists in the 'endpoints/db/import.php' endpoint. On fresh or unconfigured installations where the user table row count is zero, an unauthenticated attacker can replace the...

CVE-2026-51736

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the clearSyslog function, reachable via a crafted POST request to /cgi-bin/cstecgi.cgi. Because no authentication is required, a network-based attacker can erase system logs , destroying evidence of pr...

CVE-2026-51735

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51678

CVE-2026-51678 affects the TOTOLINK T6 router, version 4.1.5cu.748_B20211015 . An incorrect access control flaw in the setSyslogCfg function allows an unauthenticated attacker on the adjacent network to alter the device's logging behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi....

EUVD-2026-68715

Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68676

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...