EUVD-2026-69193

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69195

Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69196

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69199

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69205

Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69207

Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the csbroker component...

CVE-2026-51769

CVE-2026-51769 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . The vulnerability is an incorrect access control in the remoteCloudUpdateCheck function, which interacts with the cs_broker component. An unauthenticated attacker can send a crafted MQTT message to trigger a re...

CVE-2026-51765

CVE-2026-51765 affects the TOTOLINK T6 mesh router on firmware 4.1.5cu.748_B20211015 . The root cause is an incorrect access control in the recvIndirectMeshInfo function, reachable through the cs_broker component. An unauthenticated attacker can send a crafted MQTT message to insert or replace me...

CVE-2026-51745

An incorrect access control flaw in the updatePriStaList function of the cs_broker component on TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows an unauthenticated, network-based attacker to refresh the primary station list by sending a crafted MQTT message. The CNA rates it CVSS 3.1 5.3 (Medi...

CVE-2026-51767

CVE-2026-51767 affects the TOTOLINK T6 (version 4.1.5cu.748_B20211015 ), an IoT device. An incorrect access control flaw in the recvClearPairCfg function of the cs_broker component allows an unauthenticated attacker to send a crafted MQTT message that resets the pairing state and reboots the devi...

CVE-2026-51752

CVE-2026-51752 is an incorrect access control vulnerability in the staticInfoSend function of TOTOLINK T6 router, version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted MQTT message to the cs_broker component, triggering static information reporting to the configured maste...

CVE-2026-51770

TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is affected by an incorrect access control vulnerability in the sendToMasterQosConfig function. An unauthenticated attacker can forward attacker-controlled QoS settings to the master by sending a crafted MQTT message to the cs_broker component. No spec...

CVE-2026-51764

An incorrect access control vulnerability in the recvSlaveCloudCheckStatus function of the TOTOLINK T6 router, firmware 4.1.5cu.748_B20211015 , allows an unauthenticated attacker to overwrite cloud-result tracking files by sending a crafted MQTT message to the cs_broker component. No CVSS metrics...

CVE-2026-51750

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the updatePriChannel function. An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to force the device to rescan and switch the primary mesh channel . This could disr...

CVE-2026-51754

An incorrect access control flaw in the updateSlaveIpList function of the TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows unauthenticated attackers to overwrite the slave IP inventory state by sending a crafted MQTT message to the cs_broker component. The vulnerability is described at the fun...

CVE-2026-51760

Incorrect access control in the informSyncUpgfw function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated attacker to mass-trigger firmware update activity across mesh slave devices by sending a crafted MQTT message to the cs_broker component. The root cause i...

CVE-2026-51751

CVE-2026-51751 is an incorrect access control vulnerability in the delSlaveDevice function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to remove a specified slave device from the local mesh manageme...

CVE-2026-51761

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51745

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the csbroker component...

CVE-2026-51750

Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the csbroker component...