CVE-2026-51637

Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh portal table information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51647

Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51647

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the getCrpcCfg function, reachable via a crafted POST request to /cgi-bin/cstecgi.cgi . The vulnerability requires no authentication , allowing an attacker to obtain cloud remote-control...

CVE-2026-51645

Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the administrative username via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67899

Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51614

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) is affected by an incorrect access control flaw in the getAccessDeviceCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain access-device policy and client state information , resulting in sensitive...

CVE-2026-51640

Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh neighbor information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51640

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the getMeshNeighborTable function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi, gaining access to mesh neighbor information . No specif...

CVE-2026-51649

CVE-2026-51649 affects the TOTOLINK T6 router in firmware version 4.1.5cu.748_B20211015 . The vulnerability is an incorrect access control in the getDiagnosisCfg function, which allows unauthenticated attackers to send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve diagnostic configu...

CVE-2026-51645

CVE-2026-51645 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the getPasswordCfg function allows an unauthenticated attacker to obtain the administrative username by sending a crafted POST request to /cgi-bin/cstecgi.cgi. This informati...

CVE-2026-51624

Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain a client MAC address via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67906

Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51621

Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive device configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51650

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the getRemoteCfg function, reachable via a crafted POST request to /cgi-bin/cstecgi.cgi . The vulnerability allows unauthenticated attackers to retrieve the remote-management enablement ...

CVE-2026-51658

Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51657

CVE-2026-51657 is an incorrect access control flaw in the getSyslogCfg function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain syslog-related configuration from the device. The prima...

CVE-2026-51656

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the getVpnPassCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve VPN pass-through and WAN ping filter settings, exposing networ...

EUVD-2026-67879

Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51663

CVE-2026-51663 is an incorrect access control vulnerability in the getWiFiApcliScan function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can trigger a wireless scan and retrieve AP-client scan results by sending a crafted POST request to /cgi-bi...

EUVD-2026-67876

Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...