CVE-2026-51684

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83836

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWanCfg function allows unauthenticated attackers to alter upstream provisioning and connectivity. This is achieved by sending a crafted POST request to th...

PT-2026-83928

Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove Smart QoS rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83889

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51709: Improper Access Control

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51675

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83875

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWiFiBasicCfg function allows unauthenticated attackers to reconfigure primary Wi-Fi settings. This is achieved by sending a crafted POST request to the...

PT-2026-83871

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51704

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51704

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51698

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51727

Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51716

Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83886

Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter wireless availability windows via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51729

Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83854

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51689

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setUpgradeFW() function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to trigger unauthor...

CVE-2026-51721

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an improper access control flaw in the setPairCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi , which allows them to alter the mesh...

CVE-2026-51701

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the setMacFilterRules function. This vulnerability allows unauthenticated attackers to modify device access control by sending a crafted POST request to the /cgi-bin/cstecgi....

CVE-2026-51687

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi...