CVE Intelligence
Home / CVEs

CVE Database

Published vulnerabilities with severity, known exploitation and official sources.

Severity
Clear

4.225 result(s)

Export this search: RSS · CSV · STIX
CVE-2026-51732 Medium · 5.3 CWE-284 Aug 31, 2026
Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6…
Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51731 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51730 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the delWiFiAclRules function of TOTOLINK T6…
Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51729 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51728 Critical · 9.8 CWE-284 Aug 31, 2026
Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6…
Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upload a crafted firmware image via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51727 Medium · 5.3 CWE-284 Aug 31, 2026
Incorrect access control in the SystemSettings function of TOTOLINK T6…
Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51726 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the delParentalRules function of TOTOLINK T6…
Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51725 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6…
Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51724 Critical · 9.8 CWE-284 Aug 31, 2026
Incorrect access control in the delSmartQosCfg function of TOTOLINK T6…
Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Smart QoS rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51723 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the UploadCustomModule function of TOTOLINK T6…
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51722 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6…
Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51721 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51720 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6…
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51719 High · 7.5 CWE-284 Aug 31, 2026
Incorrect access control in the delUrlFilterRules function of TOTOLINK T6…
Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51718 Critical · 9.8 CWE-284 Aug 31, 2026
Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6…
Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51717 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the setOpModeCfg function of TOTOLINK T6…
Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51716 High · 7.5 CWE-284 Aug 31, 2026
Incorrect access control in the delPortForwardRules function of TOTOLINK T6…
Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51715 Critical · 9.8 CWE-284 Aug 31, 2026
Incorrect access control in the delMacFilterRules function of TOTOLINK T6…
Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51714 Medium · 5.9 CWE-284 Aug 31, 2026
Incorrect access control in the setRoamingCfg function of TOTOLINK T6…
Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter roaming behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51713 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the setManualDialCfg function of TOTOLINK T6…
Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51712 Medium · 5.9 CWE-284 Aug 31, 2026
Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6…
Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter wireless availability windows via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51711 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6…
Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51710 Critical · 9.1 CWE-284 Aug 31, 2026
Incorrect access control in the setParentalRules function of TOTOLINK T6…
Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51709 Critical · 9.8 CWE-284 Aug 31, 2026
Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6…
Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51708 Critical · 9.8 CWE-284 Aug 31, 2026
Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6…
Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi.