CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain Wi-Fi scheduling rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain advanced wireless settings via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 allows unauthenticated attackers to obtain WPS runtime status via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getDdnsCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 allows unauthenticated attackers to obtain static DHCP reservation rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 allows unauthenticated attackers to generate and retrieve a new WPS PIN via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getIptvCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getStationMacByIp function of TOTOLINK T6 allows unauthenticated attackers to obtain a client MAC address via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getDdnsStatus function of TOTOLINK T6 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWanCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain WAN configuration data via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getInitCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain sensitive device configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain network topology and interface configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getOnlineClient function of TOTOLINK T6 allows unauthenticated attackers to obtain online client information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWizardCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWanIeCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS