PT-2026-84242

Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the cs broker component...

PT-2026-84224

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the cs broker component...

PT-2026-84220

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the cs broker component...

PT-2026-84202

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84203

Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84207

Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the cs broker component...

PT-2026-84205

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the recv mesh info sync function allows unauthenticated attackers to force mesh configuration synchronization from a host under their control. This is achieved b...

PT-2026-84204

Incorrect access control in the guest wifi sync function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the cs broker component...

CVE-2026-51769

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...

CVE-2026-51770

Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the csbroker component...

CVE-2026-51768

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51767

Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51770

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is affected by an incorrect access control vulnerability in the sendToMasterQosConfig function. An unauthenticated attacker can forward attacker-controlled Quality of Service (QoS) settings to the master by sending a crafted MQTT message to the cs_...

CVE-2026-51768

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the setElinkQosConfig function. This vulnerability allows unauthenticated attackers to modify privileged QoS policies on the master device by sending a crafted MQTT message to the c...

CVE-2026-51767

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to incorrect access control within the recvClearPairCfg function. This flaw allows unauthenticated attackers to send a specially crafted MQTT message to the cs_broker component. Successful exploitation c...

CVE-2026-51769

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is susceptible to an incorrect access control vulnerability in the remoteCloudUpdateCheck function. An unauthenticated attacker can exploit this by sending a crafted MQTT message to the cs_broker component, which allows them to restar...

CVE-2026-51761

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51766

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69380

Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69379

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...