Skip to content
OpenAdvisories

Weakness (CWE)

CWE-284: Improper Access Control

Pillar Incomplete Mapping discouraged

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it (2 mitigations)

  1. Architecture and Design, Operation

    Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

  2. Architecture and Design

    Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

    Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-284

All Critical High Medium Low Exploited only Public exploit

8,237 results · Feed

  • Critical 9.1
    CVE-2026-51646

    Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

  • Medium 4.3
    CVE-2026-51610

    Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

  • Medium 4.3
    CVE-2026-51614

    Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • Medium 4.3
    CVE-2026-51656

    Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

  • Medium 4.3
    CVE-2026-51655

    Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …

  • High 7.5
    CVE-2026-51620

    Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

  • Critical 9.1
    CVE-2026-51661

    Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate…

  • High 7.5
    CVE-2026-51642

    Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate…

  • Medium 4.3
    CVE-2026-51634

    Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • Critical 9.1
    CVE-2026-51626

    Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

  • High 7.5
    CVE-2026-51615

    Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

  • Medium 4.3
    CVE-2026-51665

    Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a…

  • Critical 9.1
    CVE-2026-51643

    Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

  • High 7.5
    CVE-2026-51644

    Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

  • Medium 4.3
    CVE-2026-51664

    Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

  • High 7.5
    CVE-2026-51619

    Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • High 7.5
    CVE-2026-51658

    Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

  • High 7.5
    CVE-2026-51625

    Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

  • Critical 9.1
    CVE-2026-51660

    Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticat…

  • High 7.5
    CVE-2026-51618

    Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

  • High 7.5
    CVE-2026-51650

    Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

  • Critical 9.1
    CVE-2026-51636

    Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • Medium 4.3
    CVE-2026-51651

    Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

  • Medium 4.3
    CVE-2026-51639

    Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • Critical 9.1
    CVE-2026-51657

    Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attac…

  • High 7.5
    CVE-2026-51616

    Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attack…

  • Medium 4.3
    CVE-2026-51633

    Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate…

  • Critical 9.1
    CVE-2026-51649

    Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at…

  • High 7.5
    CVE-2026-51623

    Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

  • High 7.5
    CVE-2026-51641

    Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …

  • Medium 4.3
    CVE-2026-51654

    Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att…

  • Critical 9.1
    CVE-2026-51622

    Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker…

  • High 7.5
    CVE-2026-51624

    Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated …

  • Medium 4.3
    CVE-2026-51613

    Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta…

  • Medium 4.3
    CVE-2026-51640

    Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticat…

  • Medium 4.3
    CVE-2026-51631

    Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • High 7.5
    CVE-2026-51662

    Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic…

  • Medium 4.3
    CVE-2026-51632

    Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…

  • Medium 4.3
    CVE-2026-51630

    Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacke…

  • Medium 4.3
    CVE-2026-51637

    Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated…