CVE-2026-51744

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) contains an incorrect access control flaw in the recv_mesh_info_sync function. An unauthenticated attacker can send a crafted MQTT message to the cs_broker component, forcing mesh configuration synchronization from an attacker-controlled host. The vul...