CVE-2026-51658: Improper Access Control

Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51645: Improper Access Control

Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the administrative username via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51627: Improper Access Control

Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51619: Improper Access Control

Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

VulnCheck KEV: CVE-2026-81578

PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078...

CVE-2026-51633: Improper Access Control

Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51639: Improper Access Control

Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain AP-specific Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51616: Improper Access Control

Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51615: Improper Access Control

Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-78618: Improper Access Control

A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request...

CVE-2026-51652: Improper Access Control

Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51665: Improper Access Control

Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51663: Improper Access Control

Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51659: Improper Access Control

Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51657: Improper Access Control

Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain syslog-related configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51656: Improper Access Control

Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51653: Improper Access Control

Incorrect access control in the getStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain storage feature state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51650: Improper Access Control

Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain remote-management enablement and port information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51649: Improper Access Control

Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51648: Improper Access Control

Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN information returned by the endpoint via sending a crafted POST request to /cgi-bin/cstecgi.cgi...