Vulnerabilities
Summary — last 7 days
New vulnerabilities3,090▲ 501 vs. last week
Critical / high1,463▲ 62 vs. last week
New active exploitation (KEV)5▼ 1 vs. last week
Unscored (no CVSS)238▲ 224 vs. last week
1,440 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Critical (9.1) | 0.51% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Critical (9.1) | 0.51% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IP and port filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | High (7.5) | 0.50% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | High (7.5) | 0.50% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Critical (9.1) | 0.51% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain syslog-related configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Medium (4.3) | 0.29% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Medium (4.3) | 0.29% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Medium (4.3) | 0.29% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain schedule or scheduled-reboot configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Medium (4.3) | 0.29% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain storage feature state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Medium (4.3) | 0.29% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Medium (4.3) | 0.29% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Smart QoS configuration and rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | High (7.5) | 0.50% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain remote-management enablement and port information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Critical (9.1) | 0.51% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | High (7.5) | 0.50% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN information returned by the endpoint via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | High (7.5) | 0.50% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Critical (9.1) | 0.51% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Critical (9.8) | 0.64% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the administrative username via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | High (7.5) | 0.50% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Critical (9.1) | 0.51% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | High (7.5) | 0.50% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh routing information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | High (7.5) | 0.50% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Medium (4.3) | 0.29% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh neighbor information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Medium (4.3) | 0.29% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain AP-specific Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Medium (4.3) | 0.29% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |
| Deferred | Medium (4.3) | 0.29% | — | Totolink T6AI | 8/28/2026 | 9/1/2026 | Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain mesh portal table information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. |