CVE-2026-51683

A vulnerability exists in the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 . An incorrect access control in the setLanCfg function allows unauthenticated attackers to modify the LAN network configuration . This can be achieved by sending a crafted POST request to the /cgi-bin...

CVE-2026-51683

Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68580

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68581

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51686

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51712

Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter wireless availability windows via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51684

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is susceptible to an incorrect access control vulnerability in the setStorageCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which allows them to alter...

CVE-2026-51692

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control vulnerability in the setWiFiGuestCfg() function. An unauthenticated attacker can send a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to establish or weaken guest wireless access ...

CVE-2026-51693

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setVpnPassCfg function. This vulnerability allows unauthenticated attackers to weaken edge filtering by sending a crafted POST request to /cgi-bin/cstecgi.cgi . No specific exploit links or r...

CVE-2026-51695

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51697

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51701

Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68583

Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service DoS via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68584

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83834

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWiFiSignalCfg function allows unauthenticated attackers to reduce wireless power or cause a Denial of Service DoS, which is a condition where the service...

EUVD-2026-68532

Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain pairing and mesh-slave configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83811

Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain pairing and mesh-slave configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83814

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51677

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control issue within the setUPnPCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi , which allows them to modify the UPnP...

CVE-2026-51681

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the setRemoteCfg function. This vulnerability allows unauthenticated attackers to expose WAN-side administration by sending a crafted POST request to the /cgi-bin/cstecgi.cgi...