EUVD-2026-68751

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51737

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an improper access control flaw in the clearTracerouteLog function. This allows unauthenticated attackers to erase traceroute logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoin...

CVE-2026-51670

The TOTOLINK T6 wireless dual-band Mesh router is vulnerable to an improper access control flaw in the getSlaveUpdate function within version 4.1.5cu.748_B20211015 . An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi. This allows the attacker to...

CVE-2026-51734

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51703

The TOTOLINK T6 wireless dual-band Mesh router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the setWiFiScheduleCfg function. This vulnerability allows unauthenticated attackers to modify the Wi-Fi availability schedule by sending a crafted...

PT-2026-83854

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51671

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51726

Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51731: Improper Access Control

Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51675: Improper Access Control

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51732

The TOTOLINK T6 wireless dual-band Mesh router (specifically version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the delWiFiScheduleCfg function. This vulnerability allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request...

CVE-2026-51735

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83900

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68673

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84000

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

PT-2026-83876

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setParentalRules function allows unauthenticated attackers to modify parental-control behavior. This is achieved by sending a specially crafted POST request ...

PT-2026-83814

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51674

The TOTOLINK T6 dual-band wireless Mesh router is vulnerable to an improper access control flaw in the setScheduleCfg function. This vulnerability affects version 4.1.5cu.748_B20211015 and allows unauthenticated attackers to configure forced reboot tasks by sending a crafted POST request to the /...

CVE-2026-51701

Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68652

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...