Total
7692 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-51626 | 2026-09-01 | N/A | 9.1 CRITICAL | ||
| Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51625 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51624 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain a client MAC address via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51623 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51622 | 2026-09-01 | N/A | 9.1 CRITICAL | ||
| Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51621 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive device configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51620 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51619 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51618 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51617 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51616 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51615 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51732 | 2026-09-01 | N/A | 5.3 MEDIUM | ||
| Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51727 | 2026-09-01 | N/A | 5.3 MEDIUM | ||
| Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51678 | 2026-09-01 | N/A | 4.3 MEDIUM | ||
| Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51667 | 2026-09-01 | N/A | 4.3 MEDIUM | ||
| Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51666 | 2026-09-01 | N/A | 4.3 MEDIUM | ||
| Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51665 | 2026-09-01 | N/A | 4.3 MEDIUM | ||
| Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51664 | 2026-09-01 | N/A | 4.3 MEDIUM | ||
| Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Telnet service enablement status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51644 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||