EUVD-2026-68511

Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68541

Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68536

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83933

Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51697

An incorrect access control vulnerability in the setIptvCfg function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to alter IPTV service configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The root cause is insufficient authorization checks...

CVE-2026-51689

CVE-2026-51689 is an incorrect access control vulnerability in the setUpgradeFW function of the TOTOLINK T6 router (firmware version 4.1.5cu.748_B20211015 ). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to trigger firmware-upgrade workflow changes , potentia...

PT-2026-83872

Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83887

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83900

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51734

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the informSlaveUpdate function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to trigger mesh slave update coordination , potentially disrupting the...

PT-2026-83855

Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to add or change static DHCP rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83979

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Important: golang

Issue Overview: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client...

EUVD-2026-68672

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Linux Distros Unpatched Vulnerability : CVE-2026-80701

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds...

RHEL 9 : xmlrpc-c (RHSA-2026:61316)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61316 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a...

PT-2026-83816

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83804

Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83857

Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to expose internal services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83858

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...