CVE Intelligence
Home / CVEs

CVE Database

Published vulnerabilities with severity, known exploitation and official sources.

Severity
Clear

4.225 result(s)

Export this search: RSS · CSV · STIX
CVE-2026-51644 High · 7.5 CWE-284 Aug 28, 2026
Incorrect access control in the getCrpcConfig function of TOTOLINK T6…
Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51643 Critical · 9.1 CWE-284 Aug 28, 2026
Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51642 High · 7.5 CWE-284 Aug 28, 2026
Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6…
Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh routing information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51641 High · 7.5 CWE-284 Aug 28, 2026
Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6…
Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51640 Medium · 4.3 CWE-284 Aug 28, 2026
Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6…
Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh neighbor information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51639 Medium · 4.3 CWE-284 Aug 28, 2026
Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6…
Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain AP-specific Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51638 Medium · 4.3 CWE-284 Aug 28, 2026
Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51637 Medium · 4.3 CWE-284 Aug 28, 2026
Incorrect access control in the getMeshPortalTable function of TOTOLINK T6…
Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh portal table information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51636 Critical · 9.1 CWE-284 Aug 28, 2026
Incorrect access control in the getWiFiAclRules function of TOTOLINK T6…
Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51635 Medium · 4.3 CWE-284 Aug 28, 2026
Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51634 Medium · 4.3 CWE-284 Aug 28, 2026
Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51633 Medium · 4.3 CWE-284 Aug 28, 2026
Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51632 Medium · 4.3 CWE-284 Aug 28, 2026
Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain advanced wireless settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51631 Medium · 4.3 CWE-284 Aug 28, 2026
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6…
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51630 Medium · 4.3 CWE-284 Aug 28, 2026
Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51629 Medium · 4.3 CWE-284 Aug 28, 2026
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6…
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51628 Critical · 9.1 CWE-284 Aug 28, 2026
Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6…
Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51627 High · 7.5 CWE-284 Aug 28, 2026
Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51626 Critical · 9.1 CWE-284 Aug 28, 2026
Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51625 High · 7.5 CWE-284 Aug 28, 2026
Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6…
Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51624 High · 7.5 CWE-284 Aug 28, 2026
Incorrect access control in the getStationMacByIp function of TOTOLINK T6…
Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain a client MAC address via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51623 High · 7.5 CWE-284 Aug 28, 2026
Incorrect access control in the getDdnsStatus function of TOTOLINK T6…
Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51622 Critical · 9.1 CWE-284 Aug 28, 2026
Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51621 High · 7.5 CWE-284 Aug 28, 2026
Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive device configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51620 High · 7.5 CWE-284 Aug 28, 2026
Incorrect access control in the getNetInfoCfg function of TOTOLINK T6…
Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.