CVE-2026-51692: Improper Access Control

Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to establish or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83885

Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83812

Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to query slave upgrade status and affect upgrade bookkeeping via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83827

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83900

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83855

Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to add or change static DHCP rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51681

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51701

Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51668

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83979

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68672

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51697

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-40463: Improper Access Control

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser...

CVE-2026-51686

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83965

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51715

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51714

Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter roaming behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51721

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

WordPress Style Kits plugin has an access control vulnerability

The WordPress Style Kits plugin is a plugin designed to extend the ability to control theme styles for Elementor page builders. The WordPress Style Kits plugin has an access control vulnerability; this vulnerability stems from improper access control measures. Attackers can exploit this...

CVE-2026-51677: Improper Access Control

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...