CVE-2026-51613: Improper Access Control

Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain device identification details via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-81767: Missing Authorization

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-81284: Missing Authorization

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

CVE-2026-51660: Improper Access Control

Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IP and port filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51641

Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51665

Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51659

Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51617

Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics...

CVE-2026-51657

Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain syslog-related configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51648

Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN information returned by the endpoint via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51624

Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain a client MAC address via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51655

Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51656

Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51649

Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51618

Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51620

Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51621

Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive device configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51658

Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51627

Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51650

Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain remote-management enablement and port information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...