CVE-2026-51761

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51750

Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the csbroker component...

CVE-2026-51760

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the informSyncUpgfw function, mediated through the cs_broker MQTT component. An unauthenticated network attacker can send a crafted MQTT message to mass-trigger firmware update activity across a...

CVE-2026-51754

CVE-2026-51754 is an incorrect access control vulnerability in the updateSlaveIpList function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). Unauthenticated attackers can overwrite the slave IP inventory state by sending a crafted MQTT message to the cs_broker component. The CVSS 3....

EUVD-2026-69379

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69378

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69377

Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51754

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69212

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-69211

Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-69210

Incorrect access control in the guestwifisync function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69209

Incorrect access control in the recvmeshinfosync function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the csbroker component...

CVE-2026-51762

Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the csbroker component...

CVE-2026-51745

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the csbroker component...

CVE-2026-51761

An incorrect access control flaw in the updateLanIp function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to refresh the LAN address state by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 score is 5.3 (Medium) with Low integr...

CVE-2026-51768

CVE-2026-51768 is an incorrect access control vulnerability in the setElinkQosConfig function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker with network access can send a crafted MQTT message to the cs_broker component to modify the privileged QoS policy ...

CVE-2026-51751

CVE-2026-51751 is a critical (CVSS 9.8) incorrect access control vulnerability in the delSlaveDevice function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015). An unauthenticated network attacker can send a crafted MQTT message to the cs_broker component to remove a specified slave device from loc...

CVE-2026-51756

An incorrect access control flaw in the meshSlaveUpgfw function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated attacker to initiate firmware flashing using existing upgrade files by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 scor...

CVE-2026-51750

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the updatePriChannel function, accessible via the cs_broker MQTT component. An unauthenticated network attacker can send a crafted MQTT message to rescan and switch the primary mesh channel , disrupting wire...

CVE-2026-51764

An incorrect access control flaw in the recvSlaveCloudCheckStatus function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated remote attacker to overwrite cloud-result tracking files by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 scor...