Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2026-51641
Alta · 7.5
CWE-284 28/08/2026
Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6…
Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51640
Média · 4.3
CWE-284 28/08/2026
Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6…
Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh neighbor information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51639
Média · 4.3
CWE-284 28/08/2026
Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6…
Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain AP-specific Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51638
Média · 4.3
CWE-284 28/08/2026
Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51637
Média · 4.3
CWE-284 28/08/2026
Incorrect access control in the getMeshPortalTable function of TOTOLINK T6…
Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh portal table information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51636
Crítica · 9.1
CWE-284 28/08/2026
Incorrect access control in the getWiFiAclRules function of TOTOLINK T6…
Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51635
Média · 4.3
CWE-284 28/08/2026
Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51634
Média · 4.3
CWE-284 28/08/2026
Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51633
Média · 4.3
CWE-284 28/08/2026
Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51632
Média · 4.3
CWE-284 28/08/2026
Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain advanced wireless settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51631
Média · 4.3
CWE-284 28/08/2026
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6…
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51630
Média · 4.3
CWE-284 28/08/2026
Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51629
Média · 4.3
CWE-284 28/08/2026
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6…
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51628
Crítica · 9.1
CWE-284 28/08/2026
Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6…
Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51627
Alta · 7.5
CWE-284 28/08/2026
Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51626
Crítica · 9.1
CWE-284 28/08/2026
Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51625
Alta · 7.5
CWE-284 28/08/2026
Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51624
Alta · 7.5
CWE-284 28/08/2026
Incorrect access control in the getStationMacByIp function of TOTOLINK T6…
Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain a client MAC address via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51623
Alta · 7.5
CWE-284 28/08/2026
Incorrect access control in the getDdnsStatus function of TOTOLINK T6…
Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51622
Crítica · 9.1
CWE-284 28/08/2026
Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51621
Alta · 7.5
CWE-284 28/08/2026
Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive device configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51620
Alta · 7.5
CWE-284 28/08/2026
Incorrect access control in the getNetInfoCfg function of TOTOLINK T6…
Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51619
Alta · 7.5
CWE-284 28/08/2026
Incorrect access control in the getOnlineClient function of TOTOLINK T6…
Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51618
Alta · 7.5
CWE-284 28/08/2026
Incorrect access control in the getWizardCfg function of TOTOLINK T6…
Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51617
Alta · 7.5
CWE-284 28/08/2026
Incorrect access control in the getSysStatusCfg function of TOTOLINK T6…
Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics via sending a crafted POST request to /cgi-bin/cstecgi.cgi.