CVE-2026-51727

Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83891

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83885

Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68642

Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51668

CVE-2026-51668 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the setLanguageCfg function allows an unauthenticated attacker to modify the device's language configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The C...

CVE-2026-51680

An incorrect access control vulnerability in the setLedCfg function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to modify LED behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS 3.1 score is 9.1 (Critical) with ...

CVE-2026-51686

CVE-2026-51686 is an incorrect access control flaw in the setWiFiEasyCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to reconfigure or disable wireless networks. The CVSS 3.1 score...

CVE-2026-51689

TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setUpgradeFW function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to trigger firmware-upgrade workflow changes, rated CVSS 9.1 (CRITICA...

CVE-2026-51701

CVE-2026-51701 is an incorrect access control flaw in the setMacFilterRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to modify the device's MAC filter rules , effectively alteri...

CVE-2026-51703

An incorrect access control flaw in the setWiFiScheduleCfg function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers on the adjacent network to alter Wi-Fi availability schedules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability carries ...

CVE-2026-51714

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) is affected by an incorrect access control flaw in the setRoamingCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter the device's roaming behavior. The CVSS 3.1 score is 5.9 (MEDIUM) , with high co...

CVE-2026-51715

CVE-2026-51715 is an incorrect access control flaw in the delMacFilterRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to remove MAC filter rules, effectively weakening network-level acce...

CVE-2026-51721

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) is affected by an incorrect access control flaw in the setPairCfg function. An unauthenticated attacker can alter the mesh pairing state by sending a crafted POST request to /cgi-bin/cstecgi.cgi over the network with no privileges or user interaction ...

CVE-2026-51724

TOTOLINK T6 router, firmware 4.1.5cu.748_B20211015 , is affected by an incorrect access control flaw in the delSmartQosCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to remove Smart QoS rules , rated CVSS 3.1 9.8 (Critical) with high impact on co...

CVE-2026-51730

CVE-2026-51730 is an incorrect access control vulnerability in the delWiFiAclRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to remove Wi-Fi ACL rules , potentially allowing unauthorize...

CVE-2026-51732

An incorrect access control flaw in the delWiFiScheduleCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 5.3 (Medium) with a ne...

CVE-2026-51734

An incorrect access control vulnerability in the informSlaveUpdate function of the TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows an unauthenticated network attacker to trigger mesh slave update coordination by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS 3.1...

CVE-2026-51668

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83979

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51740

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...