CVE-2026-51670

TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) contains an incorrect access control flaw in the getSlaveUpdate function. An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to query slave upgrade status and affect upgrade bookkeeping. CISA SSVC rates t...

CVE-2026-51670

Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to query slave upgrade status and affect upgrade bookkeeping via sending a crafted POST request to /cgi-bin/cstecgi.cgi...