PT-2026-83835

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setUpgradeFW function allows unauthenticated attackers to trigger firmware-upgrade workflow changes. This is achieved by sending a crafted POST request to th...

EUVD-2026-68584

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51689

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51691

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51692

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control vulnerability in the setWiFiGuestCfg() function. An unauthenticated attacker can send a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to establish or weaken guest wireless access ...

EUVD-2026-68582

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51684

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is susceptible to an incorrect access control vulnerability in the setStorageCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which allows them to alter...

EUVD-2026-68580

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51687

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51687

TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setWiFiEasyGuestCf function. This vulnerability allows unauthenticated attackers to create or weaken guest wireless access by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. ...

CVE-2026-51688

Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service DoS via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83834

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWiFiSignalCfg function allows unauthenticated attackers to reduce wireless power or cause a Denial of Service DoS, which is a condition where the service...

EUVD-2026-68583

Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service DoS via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51705

The TOTOLINK T6 (version 4.1.5cu.748_B20211015) is affected by an incorrect access control vulnerability in the setWiFiMeshName function. An unauthenticated attacker can rename mesh entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No information regarding specific remediation or...

EUVD-2026-68644

Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51686

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68581

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83830

Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68589

Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to add or change static DHCP rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51693

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setVpnPassCfg function. This vulnerability allows unauthenticated attackers to weaken edge filtering by sending a crafted POST request to /cgi-bin/cstecgi.cgi . No specific exploit links or r...