PT-2026-83830

Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83832

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51713

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68538

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83836

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWanCfg function allows unauthenticated attackers to alter upstream provisioning and connectivity. This is achieved by sending a crafted POST request to th...

EUVD-2026-68754

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51697

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51694

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the setStaticDhcpRules function. This vulnerability allows unauthenticated attackers to add or modify static DHCP rules by sending a specially crafted ...

EUVD-2026-68588

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83834

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWiFiSignalCfg function allows unauthenticated attackers to reduce wireless power or cause a Denial of Service DoS, which is a condition where the service...

EUVD-2026-68633

Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83892

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the delStaticDhcpRules function allows unauthenticated attackers to remove static DHCP reservations. This is achieved by sending a crafted POST request to the...

PT-2026-83931

Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68749

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51737

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83826

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setSyslogCfg function allows unauthenticated attackers to alter logging behavior. This is achieved by sending a crafted POST request to the...

EUVD-2026-68541

Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51720

Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68589

Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to add or change static DHCP rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83828

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...