CVE-2026-51730: Improper Access Control

Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51722: Improper Access Control

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51695: Improper Access Control

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51714: Improper Access Control

Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter roaming behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51670: Improper Access Control

Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to query slave upgrade status and affect upgrade bookkeeping via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-82597: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-51711: Improper Access Control

Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51716: Improper Access Control

Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51705: Improper Access Control

Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51719: Improper Access Control

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-82691: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usbdevice.cgi of the component CGI Handler. Such manipulation of the argument fupsip leads to os command injection. The attac...

CVE-2026-51679: Improper Access Control

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51699: Improper Access Control

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51733: Improper Access Control

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51667: Improper Access Control

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51697: Improper Access Control

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83202

Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain mesh portal table information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51646: Improper Access Control

Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51610: Improper Access Control

Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51619: Improper Access Control

Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...