PT-2026-83856

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51703

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83862

Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51688

CVE-2026-51688 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . The root cause is an incorrect access control in the setWiFiSignalCfg function, which is exposed via the endpoint /cgi-bin/cstecgi.cgi. An unauthenticated attacker on the network can send a crafted POST request...

PT-2026-83833

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWiFiEasyGuestCf function allows unauthenticated attackers to create or weaken guest wireless access. This is achieved by sending a crafted POST request to...

CVE-2026-51683

Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83899

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83825

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51690

An incorrect access control vulnerability in the setWanCfg function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows an unauthenticated remote attacker to alter upstream provisioning and connectivity by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 9.1 (CRITI...

PT-2026-83701

A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can...

CVE-2026-51738

Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51709

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51669

Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain pairing and mesh-slave configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51674

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51677

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51672

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51671

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51730

Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51692

Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to establish or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51690

Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi...