CVE-2026-51769

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...

CVE-2025-60682

A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614B20230630 within the cloudupdatecheck binary, specifically in the sub402414 function that handles cloud update parameters. User-supplied 'magicid' and 'url' values are directly concatenated into shell...