TOTOLink T6 is a wireless dual-band router from TotoLink, China.TOTOLink T10 is a wireless network system router from TotoLink, China.A command injection vulnerability exists in the meshSlaveUpdate function of TOTOLINK Technology Routers T6 and T10. An attacker can exploit this vulnerability to execute arbitrary commands via specially crafted MQTT packets.