TOTOLINK T6 vulnerabilities
55 known CVE vulnerabilities in TOTOLINK T6, translated and rated.
- CVE-2026-51615Low risk· EPSS 7%
Incorrect access control in the getLanCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51614Low risk· EPSS 7%
Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain access-device policy and client state information via a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51613Low risk· EPSS 7%
Incorrect access control in the getDeviceInfo function of TOTOLINK T6 allows unauthenticated attackers to obtain device identification details via a crafted POST request to /cgi-bin/cstecgi.cgi.
- CVE-2026-51611Low risk· EPSS 7%
Incorrect access control in the startSlaveReboot function of TOTOLINK T6 allows unauthenticated attackers to arbitrarily force a reboot via a crafted MQTT message.
- CVE-2026-51610Low risk· EPSS 7%
Incorrect access control in the RebootSystem function of TOTOLINK T6 allows unauthenticated attackers to arbitrarily force an immediate reboot via a crafted POST request to /cgi-bin/cstecgi.cgi.