CVE-2026-51770

TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is affected by an incorrect access control vulnerability in the sendToMasterQosConfig function. An unauthenticated attacker can forward attacker-controlled QoS settings to the master by sending a crafted MQTT message to the cs_broker component. No spec...