EUVD-2026-68531

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83876

Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68652

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51674

CVE-2026-51674 is an incorrect access control flaw in the setScheduleCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated, remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to configure forced reboot tasks , resulting in high impact to...

CVE-2026-51675

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the setWanIeCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to reconfigure the device's uplink settings, achieving high confidentiality and inte...

CVE-2026-51681

An incorrect access control flaw in the setRemoteCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi , thereby exposing the device's WAN-side administration interface. The vulnerability i...

CVE-2026-51684

TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setStorageCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter the storage-related service state, with no user interaction requir...

CVE-2026-51687

An incorrect access control vulnerability in the setWiFiEasyGuestCf function of the TOTOLINK T6 wireless router (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to create or weaken guest wireless access by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability...

CVE-2026-51691

CVE-2026-51691 is a critical (CVSS 9.8) incorrect access control vulnerability in the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . The flaw resides in the setUploadSetting function, which is reachable via a crafted POST request to /cgi-bin/cstecgi.cgi. An unauthenticated network a...

CVE-2026-51694

CVE-2026-51694 affects TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the setStaticDhcpRules function, exposed via the endpoint /cgi-bin/cstecgi.cgi , allows an unauthenticated attacker to add or modify static DHCP rules by sending a crafted POST ...

CVE-2026-51700

An incorrect access control flaw in the setWiFiAdvancedCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated remote attacker to degrade wireless behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 9.1 (CRITICAL) wi...

CVE-2026-51708

CVE-2026-51708 is a critical (CVSS 9.8) incorrect access control vulnerability in the setWiFiWpsCfg function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated, network-based attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to change WPS availabi...

CVE-2026-51718

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 has an incorrect access control flaw in the delStaticDhcpRules function, allowing an unauthenticated attacker to remove static DHCP reservations by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The vulnerability is rated CVSS 9.8 (Critical) wi...

CVE-2026-51723

CVE-2026-51723 is an incorrect access control vulnerability in the UploadCustomModule function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to install a custom CGI module on the device. The CVSS 3.1 ...

CVE-2026-51727

An incorrect access control vulnerability in the SystemSettings function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to retrieve administrative import and export endpoint information by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CV...

CVE-2026-51739

CVE-2026-51739 affects the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 . The vulnerability is an incorrect access control in the CloudSrvVersionCheck function, which allows unauthenticated attackers to trigger cloud update checks by sending a crafted POST request to /cgi-bin...

EUVD-2026-68581

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51687

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51691

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68584

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi...