CVE-2026-51670

Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to query slave upgrade status and affect upgrade bookkeeping via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-79745: Missing Authorization

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

EUVD-2026-68645

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51715

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68675

Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51699: Improper Access Control

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51714

Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter roaming behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83869

Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter firewall policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51739

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51697: Improper Access Control

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68590

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51675

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51675

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83899

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51681

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51713

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51740

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51716: Improper Access Control

Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83815

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68539

Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...