CVE-2026-51713

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the setManualDialCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to manipulate the WAN dial state , potentially disrupting internet conn...

CVE-2026-51690

CVE-2026-51690 affects the TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ). An incorrect access control flaw in the setWanCfg function allows unauthenticated attackers to alter upstream provisioning and connectivity by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific patche...

CVE-2026-51688

An incorrect access control flaw in the setWiFiSignalCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi, resulting in a reduction of wireless power or a Denial of Service (DoS) . No spe...

CVE-2026-51696

CVE-2026-51696 is an incorrect access control vulnerability in the setPortForwardRules function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to expose internal services. The root cause is in...

CVE-2026-51695

An incorrect access control flaw in the setDdnsCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to alter the device's dynamic DNS state by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability is exposed on the router's ...

CVE-2026-51672

An incorrect access control flaw exists in the getRoamingCfg function of the TOTOLINK T6 router (firmware version 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain the roaming enablement flag , resulting in information disclosure...

CVE-2026-51679

CVE-2026-51679 affects the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 . The root cause is an incorrect access control flaw in the setPasswordCfg function, accessible via the /cgi-bin/cstecgi.cgi endpoint. An unauthenticated attacker can exploit this by sending a crafted POS...

CVE-2026-51678

CVE-2026-51678 is an incorrect access control vulnerability in the setSyslogCfg function of the TOTOLINK T6 router (firmware version 4.1.5cu.748_B20211015 ). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter the device's logging behavior . No specific pa...

CVE-2026-51706

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the setSmartQosCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to degrade traffic handling (QoS configuration) on the affected device. No specific expl...

CVE-2026-51712

CVE-2026-51712 affects the TOTOLINK T6 router on firmware version 4.1.5cu.748_B20211015 . The vulnerability is an incorrect access control in the setApWiFiSchCfg function, which allows an unauthenticated attacker to alter wireless availability windows by sending a crafted POST request to /cgi-bin...

EUVD-2026-68534

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68585

Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68537

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68592

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68586

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68544

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51717

CVE-2026-51717 is an incorrect access control vulnerability in the setOpModeCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to change the device operating mode. No CVSS metrics are currently a...

EUVD-2026-68512

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51676

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the setAccessDeviceCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter access-device policies on the target. No specific patch vers...

CVE-2026-51697

An incorrect access control vulnerability in the setIptvCfg function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to alter IPTV service configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The root cause is insufficient authorization checks...