PT-2026-83899

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83871

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83852

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setUploadSetting function allows unauthenticated attackers to manipulate the upload or flash workflow. This is achieved by sending a crafted POST request to...

PT-2026-83889

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83874

Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68712

Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68715

Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51735

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51734

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51733

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51733

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the FirmwareUpgrade() function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, which...

CVE-2026-51680

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

ROS-20260831-73-0011

The vulnerability of the HttpObjectDecoder component in the framework for developing network applications, servers, and Netty protocol clients is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected...

CVE-2026-51739

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51740

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw within the killProcess function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi, leading to the te...

PT-2026-83960

Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83928

Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove Smart QoS rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84031

Name of the Vulnerable Software and Affected Versions MapSVG versions prior to 8.15.1 Description An unauthenticated Server Side Request Forgery SSRF exists in the MapSVG plugin. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended locatio...

PT-2026-83978

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83977

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the LoadDefSettings function allows unauthenticated attackers to reset the device configuration and reboot the device. This is achieved by sending a crafted POST...