CVE-2026-51619

Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51613

Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain device identification details via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51641

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is affected by an incorrect access control vulnerability within the getWiFiMeshConfig function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi. This allows the attacker to obtain sens...

CVE-2026-51636

A vulnerability exists in the TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 due to incorrect access control in the getWiFiAclRules function. This flaw allows unauthenticated attackers to obtain Wi-Fi ACL rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Th...

CVE-2026-51635

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the getWiFiScheduleCfg function. This vulnerability allows unauthenticated attackers to obtain internal Wi-Fi scheduling rules by sending a crafted POST request to the /c...

CVE-2026-51633

The TOTOLINK T6 router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to incorrect access control within the getWiFiEasyGuestCfg function. This flaw allows unauthenticated attackers to obtain simplified guest Wi-Fi configurations, including sensitive guest credentials , by sending a ...

CVE-2026-51610

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw within the RebootSystem function. This vulnerability allows unauthenticated attackers to arbitrarily force an immediate reboot of the device by sending a crafted POST request...

CVE-2026-51638

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the getWiFiGuestCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi to obtain sensitive guest Wi-Fi configuration information....

CVE-2026-51646

The TOTOLINK T6 router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the getParentalRules function. An unauthenticated attacker can obtain parental-control rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No informa...

CVE-2026-51642

The TOTOLINK T6 (version 4.1.5cu.748_B20211015) is susceptible to an incorrect access control vulnerability within the getMeshRoutingTable function. This flaw allows unauthenticated attackers to retrieve sensitive mesh routing information by sending a crafted POST request to the /cgi-bin/cstecgi....

CVE-2026-51613

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw within the getDeviceInfo function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. This flaw allows the a...

CVE-2026-51619

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , contains an incorrect access control vulnerability in the getOnlineClient function. This flaw allows unauthenticated attackers to obtain online client information by sending a crafted POST request to the /cgi-bin/cstecgi.cgi...

CVE-2026-51622

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getWanCfg function. An unauthenticated attacker can obtain sensitive WAN configuration data by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific exploit detail...

EUVD-2026-67876

Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67884

Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain remote-management enablement and port information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67925

Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67887

Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh portal table information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67886

Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67888

Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67895

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...