CVE-2026-51663

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the getWiFiApcliScan function. An unauthenticated attacker can trigger wireless scans and retrieve AP-client scan results by sending a crafted POST request to the /cgi-bin/cstecgi.cg...

FreeBSD : Gitlab -- Vulnerabilities (161b1c49-a29b-11f1-a883-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 161b1c49-a29b-11f1-a883-2cf05da270f3 advisory. Gitlab reports: Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude A...

CVE-2026-51664: Improper Access Control

Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Telnet service enablement status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51611

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the startSlaveReboot function. This vulnerability allows unauthenticated attackers to arbitrarily force a device reboot by sending a crafted MQTT message . The provided documents do ...

CVE-2026-51624

Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain a client MAC address via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

VulnCheck KEV: CVE-2026-81578

PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078...

CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

EUVD-2026-67910

Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51651

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is susceptible to an incorrect access control vulnerability in the getSmartQosCfg function. This flaw allows unauthenticated attackers to obtain Smart QoS configuration and rules by sending a crafted POST request to /cgi-bin...

EUVD-2026-67896

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83294

R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users'...

EUVD-2026-67913

Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain device identification details via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83178

Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain device identification details via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83189

Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain a client MAC address via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67889

Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67890

Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67905

Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive device configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67919

Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83206

Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67922

Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...