CVE-2026-51732

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51734

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51735

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51733

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68678

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68676

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68534

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68544

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51699

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83826

Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51704

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51708

Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51710

Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51672

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83777

Name of the Vulnerable Software and Affected Versions diem-project diem versions prior to 5.1.4 Description An OS command injection flaw exists in the Administrative Console component. A remote attacker can exploit this by manipulating the dm command argument passed to the executeCommand function...

PT-2026-83852

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setUploadSetting function allows unauthenticated attackers to manipulate the upload or flash workflow. This is achieved by sending a crafted POST request to...

CVE-2026-51740

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the killProcess function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to terminate critical services on the device. The vulnerability is scored CVSS 9.8 (Critical)...

CVE-2026-51712

CVE-2026-51712 is an incorrect access control vulnerability in the setApWiFiSchCfg function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker on the network can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter the device's wireless availabi...

CVE-2026-51706

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the setSmartQosCfg function. An unauthenticated attacker on an adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to degrade traffic handling , resulting in a low a...

CVE-2026-51695

An incorrect access control flaw in the setDdnsCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated attacker to alter the device's dynamic DNS configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The flaw scores CVSS 3.1: 7.5 (High...