CVE-2026-51681

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51713

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68539

Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51679

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an improper access control flaw within the setPasswordCfg function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoi...

CVE-2026-51731

Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83813

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51740

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68651

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51700

Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83978

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83856

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51699

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51700: Improper Access Control

Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83929

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51698: Improper Access Control

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83886

Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter wireless availability windows via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68543

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51706

Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade traffic handling via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51703

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68638

Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi...