PT-2026-83178

Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain device identification details via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51624

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the getStationMacByIp function. This vulnerability allows unauthenticated attackers to obtain a client's MAC address by sending a crafted POST request to the /cgi-bin/cste...

CVE-2026-51617

Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics...

CVE-2026-51648

Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN information returned by the endpoint via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51649

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getDiagnosisCfg function. This vulnerability allows unauthenticated attackers to obtain sensitive diagnostic configuration and ping log contents by sending a crafted POST...

CVE-2026-51635

Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83225

Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain IP and port filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67907

Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51614

Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain access-device policy and client state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83340

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the getWiFiApcliScan function allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results. This is achieved by sending a craft...

CVE-2026-51644

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getCrpcConfig function. This vulnerability allows unauthenticated attackers to obtain cloud remote-control status and URL information by sending a crafted POST request to the /c...

PT-2026-83219

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the getScheduleCfg function allows unauthenticated attackers to obtain schedule or scheduled-reboot configuration information. This is achieved by sending a...

PT-2026-83179

Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain access-device policy and client state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83302

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

CVE-2026-51646: Improper Access Control

Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51646

The TOTOLINK T6 router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the getParentalRules function. An unauthenticated attacker can obtain parental-control rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No informa...

CVE-2026-51665

Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83215

Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain remote-management enablement and port information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51641

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is affected by an incorrect access control vulnerability within the getWiFiMeshConfig function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi. This allows the attacker to obtain sens...

PT-2026-83091

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query request...