CVE-2026-51747

Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the csbroker component...

CVE-2026-51756

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69199

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51770

TOTOLINK T6 mesh WiFi system (firmware 4.1.5cu.748_B20211015) has an incorrect access control flaw in the sendToMasterQosConfig function. An unauthenticated remote attacker can send a crafted MQTT message to the cs_broker component to forward attacker-controlled QoS settings to the master node. T...

EUVD-2026-69380

Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69193

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51768

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51745

An incorrect access control flaw in the updatePriStaList function of the cs_broker component on TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows an unauthenticated, network-based attacker to refresh the primary station list by sending a crafted MQTT message. The CNA rates it CVSS 3.1 5.3 (Medi...

CVE-2026-51767

CVE-2026-51767 is a critical (CVSS 3.1: 9.8 ) incorrect access control vulnerability in the recvClearPairCfg function of the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker on the network can send a crafted MQTT message to the cs_broker component to reset th...

CVE-2026-51757

CVE-2026-51757 is a critical access-control flaw (CVSS 9.8 ) in the TOTOLINK T6 mesh router, firmware 4.1.5cu.748_B20211015 . The meshSlaveUpdate function in the cs_broker component does not properly validate incoming requests, allowing an unauthenticated remote attacker to send a crafted MQTT me...

CVE-2026-51750

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the updatePriChannel function, accessible via the cs_broker MQTT component. An unauthenticated network attacker can send a crafted MQTT message to rescan and switch the primary mesh channel , disrupting wire...

EUVD-2026-69194

Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the csbroker component...

CVE-2026-51761

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51750

Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69378

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51761

An incorrect access control flaw in the updateLanIp function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to refresh the LAN address state by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 score is 5.3 (Medium) with Low integr...

CVE-2026-51754

CVE-2026-51754 is an incorrect access control vulnerability in the updateSlaveIpList function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). Unauthenticated attackers can overwrite the slave IP inventory state by sending a crafted MQTT message to the cs_broker component. The CVSS 3....

CVE-2026-51760

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the informSyncUpgfw function, mediated through the cs_broker MQTT component. An unauthenticated network attacker can send a crafted MQTT message to mass-trigger firmware update activity across a...

CVE-2026-51768

CVE-2026-51768 is an incorrect access control vulnerability in the setElinkQosConfig function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker with network access can send a crafted MQTT message to the cs_broker component to modify the privileged QoS policy ...

CVE-2026-51756

An incorrect access control flaw in the meshSlaveUpgfw function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated attacker to initiate firmware flashing using existing upgrade files by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 scor...