CVE-2026-51754

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control vulnerability in the updateSlaveIpList function. This flaw allows unauthenticated attackers to overwrite the slave IP inventory state by sending a crafted MQTT message to the cs_broker compon...

CVE-2026-51757

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51756

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component...

CVE-2026-51756

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control issue in the meshSlaveUpgfw function. An unauthenticated attacker can trigger a firmware update by sending a specially crafted MQTT message to the cs_broker component, whic...

CVE-2026-51757

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the meshSlaveUpdate function. An unauthenticated attacker can trigger a firmware download or flash workflow on a slave device by sending a crafted MQTT message to the cs_broker comp...

CVE-2026-51764

Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the csbroker component...

CVE-2026-51765

Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the csbroker component...

CVE-2026-51763

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the csbroker component...

CVE-2026-51762

Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the csbroker component...

CVE-2026-51766

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51761

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51760

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51766

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the setDevReboot function. This vulnerability allows unauthenticated attackers to reboot the local device. Furthermore, an attacker can send a crafted MQTT message to the cs_bro...

CVE-2026-51760

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the informSyncUpgfw() function. Unauthenticated attackers can exploit this by sending a crafted MQTT message to the cs_broker component. This allows th...

CVE-2026-51763

The TOTOLINK T6 wireless dual-band Mesh router is vulnerable to an incorrect access control flaw in the freeStaClient function (version 4.1.5cu.748_B20211015 ). An unauthenticated attacker can exploit this by sending a specially crafted MQTT message to the cs_broker component, which allows them t...

CVE-2026-51764

The TOTOLINK T6 (version 4.1.5cu.748_B20211015) is vulnerable to an incorrect access control flaw within the recvSlaveCloudCheckStatus function. This vulnerability allows unauthenticated attackers to overwrite cloud-result tracking files by sending a crafted MQTT message to the cs_broker componen...

CVE-2026-51762

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the meshInfoKick function. An unauthenticated attacker can exploit this by sending a crafted MQTT message to the cs_broker component. This allows the attac...

CVE-2026-51761

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , contains an incorrect access control vulnerability in the updateLanIp function. This flaw allows unauthenticated attackers to refresh the LAN address state by sending a crafted MQTT message to the cs_broker component. No spe...

CVE-2026-51765

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the recvIndirectMeshInfo function. An unauthenticated attacker can exploit this by sending a crafted MQTT message to the cs_broker component to insert or replace me...

EUVD-2026-69193

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...