CVE-2026-51667

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51666

Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51730

The TOTOLINK T6 wireless dual-band Mesh router is vulnerable to an incorrect access control flaw in the delWiFiAclRules function, specifically affecting version 4.1.5cu.748_B20211015 . An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi to remove...

CVE-2026-51700

The TOTOLINK T6 wireless dual-band Mesh router is vulnerable to an improper access control issue within the setWiFiAdvancedCfg function in version 4.1.5cu.748_B20211015 . This flaw allows unauthenticated attackers to degrade wireless behavior by submitting a specially crafted POST request to the ...

PT-2026-83826

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setSyslogCfg function allows unauthenticated attackers to alter logging behavior. This is achieved by sending a crafted POST request to the...

EUVD-2026-68652

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83874

Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68590

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51711

Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83962

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the FirmwareUpgrade function allows unauthenticated attackers to remove Wi-Fi schedule entries. This is achieved by sending a crafted POST request to the...

PT-2026-83928

Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove Smart QoS rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51727

Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83804

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWizardCfg function allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state. This is achieved by sending a crafted POST...

CVE-2026-51717

The TOTOLINK T6 wireless dual-band Mesh router is vulnerable to an improper access control flaw in the setOpModeCfg function. This vulnerability allows unauthenticated attackers to change the device's operating mode by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint....

CVE-2026-51726

Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83930

Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68584

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51723

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the UploadCustomModule function. This vulnerability allows unauthenticated attackers to install a custom CGI module by sending a specially crafted POST...

PT-2026-83979

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the killProcess function allows unauthenticated attackers to terminate critical services. This is achieved by sending a crafted POST request to the...

CVE-2026-51739

The TOTOLINK T6 wireless dual-band Mesh router is vulnerable to an incorrect access control flaw in the CloudSrvVersionCheck function. This vulnerability affects version 4.1.5cu.748_B20211015 . An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi....