CVE-2026-51710

Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51705

Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51704

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51703

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51708

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the setWiFiWpsCfg function. This vulnerability allows unauthenticated attackers to modify WPS availability by sending a crafted POST request to the /cgi-bin/cstecgi.cgi en...

CVE-2026-51703

The TOTOLINK T6 wireless dual-band Mesh router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the setWiFiScheduleCfg function. This vulnerability allows unauthenticated attackers to modify the Wi-Fi availability schedule by sending a crafted...

PT-2026-83834

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWiFiSignalCfg function allows unauthenticated attackers to reduce wireless power or cause a Denial of Service DoS, which is a condition where the service...

PT-2026-83833

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWiFiEasyGuestCf function allows unauthenticated attackers to create or weaken guest wireless access. This is achieved by sending a crafted POST request to...

PT-2026-83830

Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83836

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWanCfg function allows unauthenticated attackers to alter upstream provisioning and connectivity. This is achieved by sending a crafted POST request to th...

PT-2026-83826

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setSyslogCfg function allows unauthenticated attackers to alter logging behavior. This is achieved by sending a crafted POST request to the...

PT-2026-83814

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83815

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83810

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83813

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83816

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83831

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setStorageCfg function allows unauthenticated attackers to alter the storage-related service state. This is achieved by sending a crafted POST request to the...

PT-2026-83832

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51716

Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51713

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...