CVE-2026-51722

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the setWiFiRepeaterCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi, which allows them to repoint the device to an...

CVE-2026-51727

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the SystemSettings function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve sensitive administrative import a...

CVE-2026-51725

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51728

Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to upload a crafted firmware image via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51729

Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51730

Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68673

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68716

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83931

Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51723

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51705

The TOTOLINK T6 (version 4.1.5cu.748_B20211015) is affected by an incorrect access control vulnerability in the setWiFiMeshName function. An unauthenticated attacker can rename mesh entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No information regarding specific remediation or...

CVE-2026-51708

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the setWiFiWpsCfg function. This flaw allows unauthenticated attackers to modify WPS availability by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. N...

CVE-2026-51709

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the setWiFiBasicCfg function. An unauthenticated attacker can reconfigure primary Wi-Fi settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific exploitation details or...

CVE-2026-51710

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , contains an incorrect access control vulnerability within the setParentalRules function. This flaw allows unauthenticated attackers to modify parental-control behavior by sending a crafted POST request to the /cgi-bin/cstecg...

CVE-2026-51711

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setWiFiWpsStart function. An unauthenticated attacker can trigger the opening of a wireless pairing window by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No ...

CVE-2026-51718

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability in the delStaticDhcpRules function. This flaw allows unauthenticated attackers to remove static DHCP reservations by sending a crafted POST request to the /cgi-bin/cstecgi.cgi end...

CVE-2026-51719

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the delUrlFilterRules function. This vulnerability allows unauthenticated attackers to remove URL filtering rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpo...

CVE-2026-51709

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51711

Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51715

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...