CVE-2026-51700: Improper Access Control

Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51697: Improper Access Control

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51696: Improper Access Control

Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose internal services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51691: Improper Access Control

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51690: Improper Access Control

Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51688: Improper Access Control

Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service DoS via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51687: Improper Access Control

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51684: Improper Access Control

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51683: Improper Access Control

Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51681: Improper Access Control

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51679: Improper Access Control

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51676: Improper Access Control

Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51675: Improper Access Control

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51673: Improper Access Control

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51674: Improper Access Control

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51672: Improper Access Control

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51670: Improper Access Control

Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to query slave upgrade status and affect upgrade bookkeeping via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51668: Improper Access Control

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51667: Improper Access Control

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51666: Improper Access Control

Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...