Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2026-51738
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the LoadDefSettings function of TOTOLINK T6…
Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51737
Média · 5.3
CWE-284 31/08/2026
Incorrect access control in the clearTracerouteLog function of TOTOLINK T6…
Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51736
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the clearSyslog function of TOTOLINK T6…
Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51735
Alta · 7.5
CWE-284 31/08/2026
Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51734
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the informSlaveUpdate function of TOTOLINK T6…
Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51733
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6…
Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51732
Média · 5.3
CWE-284 31/08/2026
Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6…
Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51731
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51730
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the delWiFiAclRules function of TOTOLINK T6…
Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51729
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51728
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6…
Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upload a crafted firmware image via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51727
Média · 5.3
CWE-284 31/08/2026
Incorrect access control in the SystemSettings function of TOTOLINK T6…
Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51726
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the delParentalRules function of TOTOLINK T6…
Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51725
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6…
Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51724
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the delSmartQosCfg function of TOTOLINK T6…
Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Smart QoS rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51723
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the UploadCustomModule function of TOTOLINK T6…
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51722
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6…
Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51721
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51720
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6…
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51719
Alta · 7.5
CWE-284 31/08/2026
Incorrect access control in the delUrlFilterRules function of TOTOLINK T6…
Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51718
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6…
Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51717
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setOpModeCfg function of TOTOLINK T6…
Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51716
Alta · 7.5
CWE-284 31/08/2026
Incorrect access control in the delPortForwardRules function of TOTOLINK T6…
Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51715
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the delMacFilterRules function of TOTOLINK T6…
Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51714
Média · 5.9
CWE-284 31/08/2026
Incorrect access control in the setRoamingCfg function of TOTOLINK T6…
Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter roaming behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.