CVE-2026-51710

Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51709

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51732

The TOTOLINK T6 wireless dual-band Mesh router (specifically version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the delWiFiScheduleCfg function. This vulnerability allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request...

CVE-2026-51696: Improper Access Control

Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose internal services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51732

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51734

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51695: Improper Access Control

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51691

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is affected by an incorrect access control vulnerability in the setUploadSetting function. This flaw allows unauthenticated attackers to manipulate the upload or flash workflow by sending a crafted POST r...

CVE-2026-51676

Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51739: Improper Access Control

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51721

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an improper access control flaw in the setPairCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi , which allows them to alter the mesh...

EUVD-2026-68592

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51719

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51675: Improper Access Control

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51705

Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83873

Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to degrade traffic handling via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68542

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51701

Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51679

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83813

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...