CVE-2026-51697

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68592

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51697

An incorrect access control flaw in the setIptvCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker to alter IPTV service configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 9.1 (CRITICAL) , reflectin...

CVE-2026-51697

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51627

Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51627

TOTOLINK T6 (version 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the getIptvCfg function, accessible via a crafted POST request to /cgi-bin/cstecgi.cgi. An unauthenticated attacker can obtain IPTV and IGMP configuration information , yielding a high confidentiality impact ...

EUVD-2026-67897

Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-5852 Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection

A weakness has been identified in Totolink A7100RU 7.4cu.2313b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument igmpVer causes os command injection. The attack is possible to be carried out remotely. The...

CVE-2026-5178 Totolink A3300R cstecgi.cgi setIptvCfg command injection

A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557b20221024. Affected by this issue is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument vlanPriLan3 leads to command injection. Remote exploitation of the attack is possible. The...

EUVD-2025-30326

Malicious code in bioql PyPI...

CVE-2025-57296

Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the subADBC0 helper function concatenates these user-supplied values into...

PT-2025-38584

Name of the Vulnerable Software and Affected Versions Tenda AC6 router firmware version 15.03.05.19 Description The Tenda AC6 router firmware contains a command injection issue in the formSetIptv function. This function handles requests to the /goform/SetIPTVCfg web interface. The list and vlanId...