IONIX THREAT CENTER

CVE-2026-51731 is an improper access control vulnerability (CWE-284) in the delVlanCfg function of the TOTOLINK T6 router's web management CGI interface, running firmware version 4.1.5cu.748_B20211015. The flaw allows an unauthenticated, remote attacker to delete VLAN configuration entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability carries a CRITICAL CVSS v3.1 base score of 9.1.

CVE-2026-51721 is an incorrect access control vulnerability in the setPairCfg function of the TOTOLINK T6 web management interface, firmware version 4.1.5cu.748_B20211015. It allows an unauthenticated remote attacker to alter the device's mesh pairing state, and has been assigned a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51726 is an improper access control vulnerability (CWE-284) in the delParentalRules function of the TOTOLINK T6 router web management interface, firmware version 4.1.5cu.748_B20211015. The flaw allows an unauthenticated, remote attacker to remove parental-control rules by sending a crafted POST request to the device's CGI handler. It carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51715 is an incorrect access control vulnerability in the delMacFilterRules function of the TOTOLINK T6 router's web management interface (firmware 4.1.5cu.748_B20211015). It allows a remote, unauthenticated attacker to remove configured MAC filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The flaw carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51729 is an incorrect access control vulnerability in the delDevice function of the TOTOLINK T6 router firmware (version 4.1.5cu.748_B20211015). The flaw allows an unauthenticated, remote attacker to send a crafted HTTP POST request to the device's CGI web management interface and delete a managed "slave" device entry without any authentication. It carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51699 is an incorrect access control (CWE-284) vulnerability in the setDmzCfg function of the TOTOLINK T6 web management interface, firmware version 4.1.5cu.748_B20211015. The CGI endpoint fails to enforce authentication on DMZ configuration requests, allowing an unauthenticated remote attacker to expose an internal host to the internet. The flaw carries a critical CVSS v3.1 score of 9.8.

CVE-2026-51724 is an improper access control vulnerability (CWE-284) affecting the delSmartQosCfg function on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015. The flaw allows an unauthenticated remote attacker to remove configured Smart QoS rules by sending a crafted POST request to the device's CGI interface. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51696 is an incorrect access control vulnerability (CWE-284) in the setPortForwardRules function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015. The flaw allows an unauthenticated remote attacker to send a crafted HTTP POST request to the device's management CGI endpoint and modify port-forwarding rules, exposing internal services to the internet. The issue carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51700 is an improper access control vulnerability (CWE-284) in the setWiFiAdvancedCfg function of the TOTOLINK T6 router's web management interface, firmware version 4.1.5cu.748_B20211015. The function fails to verify that the requester is authenticated before processing wireless configuration changes, allowing a remote, unauthenticated attacker to submit a crafted request that degrades wireless behavior. The flaw carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51734 is an incorrect access control vulnerability (CWE-284) in the informSlaveUpdate function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015. The flaw allows an unauthenticated remote attacker to trigger mesh slave update coordination logic on the device by sending a crafted POST request to the device's web management CGI endpoint. The issue is rated CRITICAL with a CVSS v3.1 base score of 9.8.

CVE-2026-51693 is a critical incorrect access control vulnerability (CVSS 9.8) in the setVpnPassCfg function of the TOTOLINK T6 router's web management interface, firmware version 4.1.5cu.748_B20211015. The endpoint fails to enforce authentication, allowing a remote, unauthenticated attacker to send a crafted POST request that weakens the device's edge filtering (firewall/VPN passthrough) configuration. This CVE is one of a large batch of similarly structured incorrect-access-control flaws disclosed in the same firmware build, all reachable through the device's /cgi-bin/cstecgi.cgi CGI handler.

CVE-2026-51698 is an incorrect access control vulnerability in the setUrlFilterRules function of TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015. The flaw allows an unauthenticated, remote attacker to modify device browsing/URL filtering policies by sending a crafted POST request to the device's /cgi-bin/cstecgi.cgi endpoint. It carries a CRITICAL CVSS v3.1 base score of 9.1.

CVE-2026-51697 is an incorrect access control vulnerability (CWE-284) in the setIptvCfg function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015. It allows an unauthenticated remote attacker to alter the device's IPTV service configuration by sending a crafted POST request to the router's /cgi-bin/cstecgi.cgi endpoint. The flaw carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51740 is an incorrect access control vulnerability in the killProcess function of the TOTOLINK T6 web management interface, firmware version 4.1.5cu.748_B20211015. The flaw allows an unauthenticated remote attacker to send a crafted POST request that terminates critical device processes, resulting in denial of service. The issue carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51152 is a Server-Side Request Forgery (SSRF) vulnerability affecting QD (QD-Today), a Chinese-language HTTP request scheduling framework built on HAR Editor and Tornado Server. The unauthenticated /har/test endpoint allows attackers to force the QD server to issue arbitrary outbound HTTP requests to internal network resources and cloud metadata services. The flaw carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51701 is an incorrect access control vulnerability (CWE-284) in the setMacFilterRules function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015. The flaw allows an unauthenticated, remote attacker to modify the device's MAC address filtering/access control rules by sending a crafted POST request to the router's CGI endpoint. The issue is rated critical with a CVSS v3.1 base score of 9.1.

CVE-2026-51717 is an incorrect access control vulnerability in the setOpModeCfg function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015. The flaw allows an unauthenticated remote attacker to send a crafted POST request to the device's /cgi-bin/cstecgi.cgi endpoint and change the router's operating mode without providing any credentials. It carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51718 is an incorrect access control vulnerability in the delStaticDhcpRules function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015. The flaw allows an unauthenticated, remote attacker to delete static DHCP reservations by sending a crafted POST request to the device's /cgi-bin/cstecgi.cgi endpoint. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-18210 is a critical SQL injection vulnerability affecting TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company's "Products's Store" application. The flaw stems from improper neutralization of special elements used in SQL commands (CWE-89), allowing an unauthenticated, remote attacker to manipulate backend SQL queries. With a CVSS v3.1 base score of 9.8 (Critical), successful exploitation can fully compromise the confidentiality, integrity, and availability of the affected system.

CVE-2026-51711 is an incorrect access control vulnerability (CWE-284) in the setWiFiWpsStart function of the TOTOLINK T6 router web management interface, firmware version 4.1.5cu.748_B20211015. The flaw allows an unauthenticated remote attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi and open a Wi-Fi Protected Setup (WPS) pairing window without any credentials. The issue carries a CVSS v3.1 base score of 9.1 (Critical) and requires no user interaction to exploit.

CVE-2026-18808 is a critical Improper Control of Generation of Code ("Code Injection", CWE-94) vulnerability affecting Klemsan Electrical Electronics Inc.'s KIO (Klemsan Internet Objects) IoT platform. The flaw allows an unauthenticated remote attacker to inject and execute arbitrary code on the affected system, resulting in unauthenticated Remote Code Execution (RCE). It carries a CVSS v3.1 base score of 9.8 (Critical), reflecting network-exploitability with no authentication or user interaction required.

CVE-2026-51709 is a critical improper access control vulnerability (CWE-284) in the setWiFiBasicCfg function of the TOTOLINK T6 router firmware. The flaw allows an unauthenticated, remote attacker to reconfigure the device's primary Wi-Fi settings by sending a crafted POST request, with no credentials or user interaction required. The issue carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51710 is an improper access control vulnerability in the setParentalRules function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015. The flaw allows an unauthenticated, remote attacker to alter the device's parental-control configuration by sending a crafted POST request to the router's CGI management interface. The issue carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51676 is an incorrect access control vulnerability in the setAccessDeviceCfg function of TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. The flaw allows an unauthenticated, remote attacker to alter access-device policies on the router by sending a crafted POST request to the device's /cgi-bin/cstecgi.cgi endpoint. It carries a CVSS v3.1 base score of 9.1 (Critical), reflecting network-exploitable, no-authentication-required impact to confidentiality and integrity.

CVE-2026-51708 is an incorrect access control vulnerability (CWE-284) in the setWiFiWpsCfg function of the TOTOLINK T6 web management interface, firmware version 4.1.5cu.748_B20211015. The flaw allows a remote, unauthenticated attacker to change the device's WPS (Wi-Fi Protected Setup) availability by sending a crafted POST request to /cgi-bin/cstecgi.cgi. It carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51675 is an incorrect access control vulnerability (CWE-284) in the setWanIeCfg function of the TOTOLINK T6 router's web management interface. Unauthenticated attackers can send a crafted POST request to /cgi-bin/cstecgi.cgi to reconfigure the device's WAN/uplink settings without providing credentials. The flaw carries a CVSS v3.1 base score of 9.1 (Critical).

CVE-2026-51674 is an incorrect access control vulnerability in the setScheduleCfg function of the /cgi-bin/cstecgi.cgi endpoint on TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015. The endpoint fails to enforce authentication, allowing a remote, unauthenticated attacker to configure forced device reboot tasks. The flaw carries a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-18765 is a critical SQL injection vulnerability affecting Teracity Software Technologies Inc.'s E-OSB platform. The flaw arises from improper neutralization of special elements used in SQL commands (CWE-89), allowing an unauthenticated, remote attacker to inject and execute arbitrary SQL queries against the backend database. The issue has been assigned a CVSS v3.1 base score of 9.8 (Critical).

CVE-2026-51669 is an incorrect access control vulnerability (CWE-284) in the getPairCfg function of TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. An unauthenticated remote attacker can send a crafted POST request to the device's CGI endpoint to retrieve pairing and mesh-slave configuration data. The flaw carries a CVSS v3.1 base score of 9.1 (Critical).