CVE-2026-102294

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...

CVE-2026-102294 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...

CVE-2026-102294

The TP-Link TL-WR841N router is susceptible to an authenticated OS command injection vulnerability within the IPv6 WAN configuration . The root cause is the improper incorporation of a crafted IPv6 Gateway value into a system command. This allows an authenticated administrator to execute arbitrar...

CVE-2026-102294 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...

EUVD-2026-90974

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...

CVE-2026-102294: Improper Neutralization of Special Elements used in an OS Command

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...

PT-2026-103951

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR841N affected versions not specified Description An authenticated OS command injection exists in the IPv6 WAN configuration. This occurs when a crafted value provided to the IPv6 Gateway is improperly incorporated into a system...

EUVD-2026-80059

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wanconfigsetcgi, wannumsetcgi, and lanipchangecgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38577)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setWizardCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...

CVE-2026-76856

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wanconfigsetcgi, wannumsetcgi, and lanipchangecgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration...

CVE-2026-76856 Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wanconfigsetcgi, wannumsetcgi, and lanipchangecgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration...

CVE-2026-76856

Netcore NR255-V firmware version 1.5.130703 is affected by a cross-site request forgery (CSRF) vulnerability in the wan_config_set_cgi , wan_num_set_cgi , and lan_ip_change_cgi endpoints. An unauthenticated attacker can craft forged requests that, when triggered by an authenticated administrator,...

CVE-2026-51666

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setWizardCfg function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to /cgi-bin/cstecgi.cgi . Successful ex...

PT-2026-83836

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWanCfg function allows unauthenticated attackers to alter upstream provisioning and connectivity. This is achieved by sending a crafted POST request to th...

CVE-2026-51622

Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51622

Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51622: Improper Access Control

Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51622

Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51622

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getWanCfg function. An unauthenticated attacker can obtain sensitive WAN configuration data by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific exploit detail...

EUVD-2026-67904

Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...