CVE-2026-51735

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51683

Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51712

The TOTOLINK T6 (version 4.1.5cu.748_B20211015) is vulnerable to an incorrect access control flaw within the setApWiFiSchCfg function. This vulnerability allows unauthenticated attackers to modify wireless availability windows by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint...

CVE-2026-51713

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability within the setManualDialCfg function. This flaw allows unauthenticated attackers to manipulate the WAN dial state by sending a crafted POST request to the /cgi-bin/cstecgi.cgi end...

CVE-2026-51717

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability within the setOpModeCfg function. This flaw allows unauthenticated attackers to change the device operating mode by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific reme...

CVE-2026-51729

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the delDevice function. This security weakness allows unauthenticated attackers to delete a managed slave device by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. E...

CVE-2026-51736

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the clearSyslog function. This vulnerability allows unauthenticated attackers to erase system logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No spe...

CVE-2026-51688

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the setWiFiSignalCfg function. An unauthenticated attacker can send a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to either reduce the wireless power or trigger a Denial of Serv...

CVE-2026-51678

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the setSyslogCfg function. This vulnerability allows unauthenticated attackers to modify the device's logging behavior by submitting a crafted POST request to the /cgi-bin...

CVE-2026-51695

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control issue within the setDdnsCfg function. This flaw allows unauthenticated attackers to alter the dynamic DNS state by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Exploitati...

CVE-2026-51670

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the getSlaveUpdate function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to query slave upgrade status and manipulate upgrade bookkeeping. No ...

CVE-2026-51679

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the setPasswordCfg function. This vulnerability allows an unauthenticated attacker to change the administrator account by sending a crafted POST request to the /cgi-bin/cstecgi.cgi ...

CVE-2026-51696

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to incorrect access control within the setPortForwardRules function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi , which may result in the exposure of internal servic...

CVE-2026-51706

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the setSmartQosCfg function. This vulnerability allows unauthenticated attackers to degrade traffic handling by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoi...

CVE-2026-51726

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the delParentalRules function. This vulnerability allows unauthenticated attackers to remove parental-control rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi...

CVE-2026-51733

The TOTOLINK T6 router (version 4.1.5cu.748_B20211015) is vulnerable to an incorrect access control flaw within the FirmwareUpgrade() function. This vulnerability allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoi...

CVE-2026-51740

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the killProcess function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi to terminate critical services. No specific expl...

CVE-2026-51732

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68537

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83799

Name of the Vulnerable Software and Affected Versions bbPress versions prior to 2.6.15 Description A missing authorization issue exists that allows the exploitation of incorrectly configured access control security levels. Recommendations Update to version 2.6.15 or later...