Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVEs (8,746)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-51719 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51718 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi....Show more Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi.Show less
CVE-2026-51717 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51716 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cg...Show more Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.Show less
CVE-2026-51715 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51714 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 5.9 MEDIUM· v3 N/A· v2 Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter roaming behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51713 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51712 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 5.9 MEDIUM· v3 N/A· v2 Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter wireless availability windows via sending a crafted POST request to /cgi-bin/cstecgi...Show more Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter wireless availability windows via sending a crafted POST request to /cgi-bin/cstecgi.cgi.Show less
CVE-2026-51711 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51710 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cg...Show more Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.Show less
CVE-2026-51709 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi....Show more Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.Show less
CVE-2026-51708 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51706 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade traffic handling via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51705 - - Sep 2, 2026 Aug 31, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51704 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51703 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cg...Show more Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cgi.Show less
CVE-2026-51702 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter firewall policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51701 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51700 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51699 - - Sep 1, 2026 Aug 31, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Previous 1...676869...438 Next