CWE-284

Improper Access Control

PillarIncomplete

Description

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Hierarchy (View 1000)

Parents

none

Children

CWE-1191
CWE-1220
CWE-1224
CWE-1231
CWE-1233
CWE-1252
CWE-1257
CWE-1259
CWE-1260
CWE-1262
CWE-1263
CWE-1267
CWE-1270
CWE-1274
CWE-1276
CWE-1280
CWE-1283
CWE-1290
CWE-1292
CWE-1294
CWE-1296
CWE-1304
CWE-1311
CWE-1312
CWE-1313
CWE-1315
CWE-1316
CWE-1317
CWE-1320
CWE-1323
CWE-1334
CWE-269
CWE-282
CWE-285
CWE-286
CWE-287
CWE-346
CWE-749
CWE-923

Related attack patterns (CAPEC)

CAPEC-19 · CAPEC-441 · CAPEC-478 · CAPEC-479 · CAPEC-502 · CAPEC-503 · CAPEC-536 · CAPEC-546 · CAPEC-550 · CAPEC-551 · CAPEC-552 · CAPEC-556 · CAPEC-558 · CAPEC-562 · CAPEC-563 · CAPEC-564 · CAPEC-578

CVEs mapped to this weakness (8,082)

page 37 of 405

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2026-51720	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51717	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51711	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51710	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51701	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51681	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51680	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51679	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51677	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51676	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51675	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51672	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51669	Totolink T6	Cri	0.59	9.1	Aug 31, 2026	Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain pairing and mesh-slave configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51661	Totolink T6	Cri	0.59	9.1	Aug 28, 2026	Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51660	Totolink T6	Cri	0.59	9.1	Aug 28, 2026	Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IP and port filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51657	Totolink T6	Cri	0.59	9.1	Aug 28, 2026	Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain syslog-related configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51649	Totolink T6	Cri	0.59	9.1	Aug 28, 2026	Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51646	Totolink T6	Cri	0.59	9.1	Aug 28, 2026	Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51643	Totolink T6	Cri	0.59	9.1	Aug 28, 2026	Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51636	Totolink T6	Cri	0.59	9.1	Aug 28, 2026	Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51720CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51717CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51711CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51710CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51701CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51681CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51680CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51679CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51677CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51676CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51675CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51672CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51669CriAug 31, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain pairing and mesh-slave configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51661CriAug 28, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51660CriAug 28, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IP and port filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51657CriAug 28, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain syslog-related configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51649CriAug 28, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51646CriAug 28, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51643CriAug 28, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51636CriAug 28, 2026
Totolink
T6
risk 0.59cvss 9.1epss 0.00
Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.