VYPR

CVE Vendor Coordination

by Shengwu00

CVEs (39)

  • CVE-2026-51644Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51643Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51642Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh routing information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51641Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51640Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh neighbor information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51639Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain AP-specific Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51638Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51637Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh portal table information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51636Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51635Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51634Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51633Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51632Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain advanced wireless settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51631Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51630Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51629Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51628Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51627Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51626Aug 28, 2026
    Totolink
    T6
    risk 0.00cvss —epss —

    Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Page 2 of 2