Skip to content
OpenAdvisories

Weakness (CWE)

CWE-284: Improper Access Control

Pillar Incomplete Mapping discouraged

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it (2 mitigations)

  1. Architecture and Design, Operation

    Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

  2. Architecture and Design

    Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

    Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-284

All Critical High Medium Low Exploited only Public exploit

8,237 results · Feed

  • Medium 4.3
    CVE-2026-51678

    Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

  • Medium 4.3
    CVE-2026-51666

    Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

  • Critical 9.1
    CVE-2026-51681

    Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

  • High 7.5
    CVE-2026-51671

    Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic…

  • Critical 9.1
    CVE-2026-51726

    Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

  • Critical 9.1
    CVE-2026-51701

    Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …

  • High 7.5
    CVE-2026-51716

    Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate…

  • Medium 5.9
    CVE-2026-51712

    Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • Critical 9.1
    CVE-2026-51697

    Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke…

  • Medium 5.3
    CVE-2026-51727

    Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

  • Critical 9.1
    CVE-2026-51713

    Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

  • Medium 5.3
    CVE-2026-51737

    Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • Critical 9.1
    CVE-2026-51711

    Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • Critical 9.1
    CVE-2026-51689

    Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

  • High 7.5
    CVE-2026-51694

    Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • Critical 9.8
    CVE-2026-51670

    Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

  • Medium 4.3
    CVE-2026-51667

    Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …

  • Critical 9.8
    CVE-2026-51715

    Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …

  • High 7.5
    CVE-2026-51673

    Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

  • Critical 9.1
    CVE-2026-51669

    Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke…

  • Medium 4.3
    CVE-2026-51704

    Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …

  • Critical 9.1
    CVE-2026-51731

    Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke…

  • Critical 9.1
    CVE-2026-51700

    Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • Critical 9.8
    CVE-2026-51674

    Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

  • Critical 9.8
    CVE-2026-51691

    Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

  • Critical 9.1
    CVE-2026-51720

    Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticat…

  • Medium 5.9
    CVE-2026-51714

    Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

  • Critical 9.1
    CVE-2026-51710

    Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

  • Critical 9.8
    CVE-2026-51724

    Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

  • Critical 9.1
    CVE-2026-51687

    Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • Critical 9.1
    CVE-2026-51692

    Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • Critical 9.1
    CVE-2026-51672

    Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

  • Critical 9.1
    CVE-2026-51722

    Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • Critical 9.8
    CVE-2026-51684

    Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

  • Medium 5.3
    CVE-2026-51732

    Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • High 7.5
    CVE-2026-51668

    Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

  • Critical 9.1
    CVE-2026-51680

    Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

  • Critical 9.1
    CVE-2026-51729

    Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

  • Critical 9.1
    CVE-2026-51698

    Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …

  • Medium 5.9
    CVE-2026-51739

    Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticat…