PT-2026-83212

Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83205

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the getMeshNeighborTable function allows unauthenticated attackers to obtain mesh neighbor information. This is achieved by sending a crafted POST request to the...

CVE-2026-51631

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51662

Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware check status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51658: Improper Access Control

Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67894

Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51630

Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83195

Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-37236

The grpc-gateway v2.28.0 component is vulnerable to Incorrect Access Control because the ServeMux.ServeHTTP function processes the X-HTTP-Method-Override header without restricting allowed methods. An attacker can send a POST request with a Content-Type of application/x-www-form-urlencoded includ...

CVE-2026-51654

Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain schedule or scheduled-reboot configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

The vulnerability of the User-Mode Power Service (UMPS) in Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the User-Mode Power Service UMPS in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

EUVD-2026-67898

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

CVE-2026-51661

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw within the getPortForwardRules function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to obtain sensiti...

PT-2026-83197

Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain advanced wireless settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51617

The TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability in the getSysStatusCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to extract sensitive information, including the firmware version...

CVE-2026-51655

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is susceptible to an incorrect access control vulnerability in the getMacFilterRules function. This flaw allows unauthenticated attackers to obtain sensitive MAC filter rules by sending a crafted POST request to the /cgi-bin...

CVE-2026-51645: Improper Access Control

Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the administrative username via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83177

Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message...

CVE-2026-51651

Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Smart QoS configuration and rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...