CVE-2026-51611

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the startSlaveReboot function. This vulnerability allows unauthenticated attackers to arbitrarily force a device reboot by sending a crafted MQTT message . The provided documents do ...

CVE-2026-51633: Improper Access Control

Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51620

Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51643: Improper Access Control

Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51661

Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-81761: Missing Authorization

Subscriber Broken Access Control in WpEvently = 5.5.0 versions...

CVE-2026-51646

Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-37236

The grpc-gateway v2.28.0 component is vulnerable to Incorrect Access Control because the ServeMux.ServeHTTP function processes the X-HTTP-Method-Override header without restricting allowed methods. An attacker can send a POST request with a Content-Type of application/x-www-form-urlencoded includ...

CVE-2026-51645

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the getPasswordCfg function. An unauthenticated attacker can obtain the administrative username by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific reme...

CVE-2026-51632: Improper Access Control

Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain advanced wireless settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

CVE-2026-51651

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is susceptible to an incorrect access control vulnerability in the getSmartQosCfg function. This flaw allows unauthenticated attackers to obtain Smart QoS configuration and rules by sending a crafted POST request to /cgi-bin...

CVE-2026-51649

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getDiagnosisCfg function. This vulnerability allows unauthenticated attackers to obtain sensitive diagnostic configuration and ping log contents by sending a crafted POST...

FreeBSD : Gitlab -- Vulnerabilities (161b1c49-a29b-11f1-a883-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 161b1c49-a29b-11f1-a883-2cf05da270f3 advisory. Gitlab reports: Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude A...

CVE-2026-51620

The TOTOLINK T6 router, specifically on firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control issue in the getNetInfoCfg function. This flaw allows unauthenticated attackers to obtain sensitive network topology and interface configuration information by sending a c...

CVE-2026-51647

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getCrpcCfg function. This vulnerability allows unauthenticated attackers to obtain cloud remote-control status and URL information by sending a crafted POST request to th...

CVE-2026-51655

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is susceptible to an incorrect access control vulnerability in the getMacFilterRules function. This flaw allows unauthenticated attackers to obtain sensitive MAC filter rules by sending a crafted POST request to the /cgi-bin...

CVE-2026-51653

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is susceptible to an incorrect access control vulnerability in the getStorageCfg function. This flaw allows unauthenticated attackers to obtain storage feature state information by sending a crafted POST request to /cgi-bin/...

CVE-2026-51614

The TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the getAccessDeviceCfg function. This vulnerability allows unauthenticated attackers to obtain sensitive access-device policy and client state information by sending a crafted POST req...

CVE-2026-51625

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control issue in the getWiFiEasyCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Successful exploitation allows the...