CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Incorrect access control in the getMacFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain MAC filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain schedule or scheduled-reboot configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getStorageCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain storage feature state information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getUPnPCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain Smart QoS configuration and rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getRemoteCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain remote-management enablement and port information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWanInfo function of TOTOLINK T6 allows unauthenticated attackers to obtain WAN information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getCrpcCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain cloud remote-control status and URL information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getParentalRules function of TOTOLINK T6 allows unauthenticated attackers to obtain parental-control rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getPasswordCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain the administrative username via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getCrpcConfig function of TOTOLINK T6 allows unauthenticated attackers to obtain cloud remote-control status and URL information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getNtpCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain NTP configuration and current time data via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh routing information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh configuration and runtime state information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh neighbor information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain AP-specific Wi-Fi scheduling rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain guest Wi-Fi configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh portal table information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 allows unauthenticated attackers to obtain Wi-Fi ACL rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS