EUVD-2026-68534

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83875

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51712

The TOTOLINK T6 (version 4.1.5cu.748_B20211015) is vulnerable to an incorrect access control flaw within the setApWiFiSchCfg function. This vulnerability allows unauthenticated attackers to modify wireless availability windows by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint...

CVE-2026-51713

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability within the setManualDialCfg function. This flaw allows unauthenticated attackers to manipulate the WAN dial state by sending a crafted POST request to the /cgi-bin/cstecgi.cgi end...

CVE-2026-51717

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability within the setOpModeCfg function. This flaw allows unauthenticated attackers to change the device operating mode by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific reme...

CVE-2026-51729

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the delDevice function. This security weakness allows unauthenticated attackers to delete a managed slave device by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. E...

CVE-2026-51688

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the setWiFiSignalCfg function. An unauthenticated attacker can send a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to either reduce the wireless power or trigger a Denial of Serv...

CVE-2026-51695

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control issue within the setDdnsCfg function. This flaw allows unauthenticated attackers to alter the dynamic DNS state by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Exploitati...

CVE-2026-51670

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the getSlaveUpdate function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to query slave upgrade status and manipulate upgrade bookkeeping. No ...

CVE-2026-51696

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to incorrect access control within the setPortForwardRules function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi , which may result in the exposure of internal servic...

CVE-2026-51706

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the setSmartQosCfg function. This vulnerability allows unauthenticated attackers to degrade traffic handling by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoi...

CVE-2026-51726

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the delParentalRules function. This vulnerability allows unauthenticated attackers to remove parental-control rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi...

CVE-2026-51733

The TOTOLINK T6 router (version 4.1.5cu.748_B20211015) is vulnerable to an incorrect access control flaw within the FirmwareUpgrade() function. This vulnerability allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoi...

CVE-2026-51733

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51693

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51708

Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51727

Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68585

Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51702

Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter firewall policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68711

Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...