EUVD-2026-68586

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83852

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setUploadSetting function allows unauthenticated attackers to manipulate the upload or flash workflow. This is achieved by sending a crafted POST request to...

CVE-2026-51691

CVE-2026-51691 is a critical (CVSS 9.8) incorrect access control vulnerability in the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . The flaw resides in the setUploadSetting function, which is reachable via a crafted POST request to /cgi-bin/cstecgi.cgi. An unauthenticated network a...