PT-2026-83190

Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51621: Improper Access Control

Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive device configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51661

Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51640

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to incorrect access control in the getMeshNeighborTable function. This flaw allows unauthenticated attackers to obtain sensitive mesh neighbor information by sending a crafted POST request to the /cgi-bin/cstec...

CVE-2026-51627

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the getIptvCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Successful exploitation allow...

CVE-2026-51621

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control issue within the getInitCfg function. This flaw allows unauthenticated attackers to retrieve sensitive device configuration information by submitting a crafted POST request to the /cgi-bin/...

PT-2026-83192

Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83306

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...

CVE-2026-51611: Improper Access Control

Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message...

CVE-2026-51632

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the getWiFiAdvancedCfg function. This vulnerability allows unauthenticated attackers to obtain advanced wireless settings by sending a crafted POST request to /cgi-bin/cst...

EUVD-2026-67910

Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51658

Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51620

The TOTOLINK T6 router, specifically on firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control issue in the getNetInfoCfg function. This flaw allows unauthenticated attackers to obtain sensitive network topology and interface configuration information by sending a c...

CVE-2026-51637

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control issue in the getMeshPortalTable function. This flaw allows unauthenticated attackers to obtain mesh portal table information by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No sp...

CVE-2026-51625: Improper Access Control

Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51639

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw within the getApWiFiSchCfg function. An unauthenticated attacker can obtain AP-specific Wi-Fi scheduling rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No s...

CVE-2026-51610

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw within the RebootSystem function. This vulnerability allows unauthenticated attackers to arbitrarily force an immediate reboot of the device by sending a crafted POST request...

CVE-2026-51637

Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh portal table information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67918

Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN information returned by the endpoint via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83184

Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...