CVE-2026-51697

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51721

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51698

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51729

Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51666

Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51667

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51720

Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51735

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51739

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51714

Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter roaming behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51691

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51687

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51731: Improper Access Control

Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51729: Improper Access Control

Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51703: Improper Access Control

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-21827: Exposure of Private Personal Information to an Unauthorized Actor

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data...

CVE-2026-51683: Improper Access Control

Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51677: Improper Access Control

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51666: Improper Access Control

Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51714

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the setRoamingCfg function. This vulnerability allows unauthenticated attackers to modify the device's roaming behavior by sending a crafted POST reque...