612938 matches found
CVE-2026-51700
An incorrect access control flaw in the setWiFiAdvancedCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated remote attacker to degrade wireless behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 9.1 (CRITICAL) wi...
CVE-2026-51692
An incorrect access control flaw in the setWiFiGuestCfg function of the TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to establish or weaken guest wireless access by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The CNA-assigned CVSS 3.1 score is 9.1 (C...
CVE-2026-51737
Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-84006
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...
CVE-2026-51720
An incorrect access control vulnerability in the delIpPortFilterRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker to delete firewall filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The NVD-assigned CVSS v3.1 score ...
EUVD-2026-68751
Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
EUVD-2026-68749
Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
EUVD-2026-68742
Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
EUVD-2026-68714
Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
EUVD-2026-68716
Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51711
Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51715
Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51710
TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control vulnerability in the setParentalRules function. An unauthenticated attacker on the network can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter parental-control behavior , with high impact t...
CVE-2026-51691
CVE-2026-51691 is a critical (CVSS 9.8) incorrect access control vulnerability in the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . The flaw resides in the setUploadSetting function, which is reachable via a crafted POST request to /cgi-bin/cstecgi.cgi. An unauthenticated network a...
CVE-2026-51727
An incorrect access control vulnerability in the SystemSettings function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to retrieve administrative import and export endpoint information by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CV...
PT-2026-83876
Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51728
Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to upload a crafted firmware image via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-83834
Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWiFiSignalCfg function allows unauthenticated attackers to reduce wireless power or cause a Denial of Service DoS, which is a condition where the service...