CVE-2026-51677

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51688

Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service DoS via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51678

Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51675

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83696

A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Customer::find phone of the file /passwordrecover.php of the component Password Recovery Interface. The manipulation of the argument phonenumber leads to sql injection. Remote...

CVE-2026-51720

An incorrect access control vulnerability in the delIpPortFilterRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker to delete firewall filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The NVD-assigned CVSS v3.1 score ...

CVE-2026-51674

CVE-2026-51674 is an incorrect access control flaw in the setScheduleCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated, remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to configure forced reboot tasks , resulting in high impact to...

CVE-2026-51677

TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the setUPnPCfg function, accessible via the /cgi-bin/cstecgi.cgi endpoint. An unauthenticated network attacker can send a crafted POST request to change the UPnP service state , achieving high confident...

CVE-2026-51739

CVE-2026-51739 affects the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 . The vulnerability is an incorrect access control in the CloudSrvVersionCheck function, which allows unauthenticated attackers to trigger cloud update checks by sending a crafted POST request to /cgi-bin...

CVE-2026-51737

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the clearTracerouteLog function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to erase traceroute logs, enabling concealment of reconnaissance activity. Th...

CVE-2026-51705

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the setWiFiMeshName function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to rename mesh entries , with a CVSS 3.1 score of 9.8 (CRITICAL) reflecting high...

CVE-2026-51709

CVE-2026-51709 is an incorrect access control vulnerability in the setWiFiBasicCfg function of the TOTOLINK T6 router, firmware 4.1.5cu.748_B20211015 . Unauthenticated attackers can reconfigure primary Wi-Fi settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS...

CVE-2026-51671

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the getCloudDownloadStatus function, exposed through the endpoint /cgi-bin/cstecgi.cgi. An unauthenticated attacker can send a crafted POST request to retrieve cloud firmware download state information...

CVE-2026-51708

CVE-2026-51708 is a critical (CVSS 9.8) incorrect access control vulnerability in the setWiFiWpsCfg function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated, network-based attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to change WPS availabi...

CVE-2026-51718

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 has an incorrect access control flaw in the delStaticDhcpRules function, allowing an unauthenticated attacker to remove static DHCP reservations by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The vulnerability is rated CVSS 9.8 (Critical) wi...

CVE-2026-51692

An incorrect access control flaw in the setWiFiGuestCfg function of the TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to establish or weaken guest wireless access by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The CNA-assigned CVSS 3.1 score is 9.1 (C...

CVE-2026-51675

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the setWanIeCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to reconfigure the device's uplink settings, achieving high confidentiality and inte...

CVE-2026-51666

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) contains an incorrect access control flaw in the setWizardCfg function. An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to reconfigure WAN, Wi-Fi, and device initialization state , with low i...

CVE-2026-51669

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the getPairCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain pairing and mesh-slave configuration data. The CVSS 3.1 score is 9.1 (Critic...

CVE-2026-51667

The TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) is affected by an incorrect access control flaw in the getWiFiIpMacTable function. An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain Wi-Fi client MAC-to-IP mappings , a low-...