CVE-2026-51675

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83899

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51681

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51713

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51740

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84053

Name of the Vulnerable Software and Affected Versions hyperledger-firefly versions prior to 1.4.1 Description A server-side request forgery SSRF exists within the Webhook Subscription component. This occurs when the url argument is manipulated in the ValidateOptions function located in the...

PT-2026-83832

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68652

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83815

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51693

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83854

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68588

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68536

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51739

The TOTOLINK T6 wireless dual-band Mesh router is vulnerable to an incorrect access control flaw in the CloudSrvVersionCheck function. This vulnerability affects version 4.1.5cu.748_B20211015 . An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi....

EUVD-2026-68543

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51680

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83828

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84035

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.7 Smarty versions prior to 5.8.2 Description Smarty is a PHP template engine that separates presentation from application logic. A flaw exists in the fetch handling within libs/plugins/function.fetch.php and...

CVE-2026-51715

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the delMacFilterRules function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi , which allows them to remove...

CVE-2026-51674

The TOTOLINK T6 dual-band wireless Mesh router is vulnerable to an improper access control flaw in the setScheduleCfg function. This vulnerability affects version 4.1.5cu.748_B20211015 and allows unauthenticated attackers to configure forced reboot tasks by sending a crafted POST request to the /...