CVE-2026-51763

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the csbroker component...

CVE-2026-51741

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51767

Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69208

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69206

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69204

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69203

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69197

Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69200

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the csbroker component...

VulnCheck KEV: CVE-2025-40553

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication...

CVE-2026-51741

An incorrect access control flaw in the clearDiagnosisLog function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated remote attacker to erase diagnosis logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The assigned CVSS 3.1 score is 9.8 (CRITICAL...

CVE-2026-51766

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the setDevReboot function. An unauthenticated, network-based attacker can send a crafted MQTT message to the cs_broker component to reboot the device. On a mesh master , the reboot command fans out to all me...

CVE-2026-51748

CVE-2026-51748 is an incorrect access control vulnerability in the sendStaticInfoToMaster function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to update stored slave inventory records, achieving a h...

CVE-2026-51763

An incorrect access control flaw in the freeStaClient function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows unauthenticated network attackers to forcibly disconnect wireless clients by sending a crafted MQTT message to the cs_broker component. The CVSS v3.1 score is 9.8 (Critical) with ...

CVE-2026-51762

TOTOLINK T6 version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the meshInfoKick function. An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to kick or clean stale mesh information/state and trigger regeneration of mesh metadata. T...

CVE-2026-51744

CVE-2026-51744 is an incorrect access control flaw in the recv_mesh_info_sync function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015). An unauthenticated remote attacker can send a crafted MQTT message to the cs_broker component to force mesh configuration synchronization from an attacker-contro...

PT-2026-84482

Name of the Vulnerable Software and Affected Versions AOS-CX switches affected versions not specified Description Issues in the operating system of AOS-CX switches may allow an unauthenticated remote actor to bypass authentication controls. This could lead to the unauthorized modification of...

PT-2026-84521

Name of the Vulnerable Software and Affected Versions Vitest versions 2.1.0 through 4.1.10 Vitest versions 5.0.0-rc.0 through 5.0.0-rc.1 Description The mockerPlugin and interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on...

CVE-2026-51742

TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the discoverWan function. An unauthenticated attacker can trigger WAN discovery logic by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 5.9 (MEDIUM) with a H...

EUVD-2026-69196

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the csbroker component...