TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38590)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the meshSlaveUpdate function. Attackers can exploit this vulnerability by sending specially crafted MQTT...

PT-2026-84239

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the cs broker component...

CVE-2026-51757: Improper Access Control

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the csbroker component...

The vulnerability of the meshSlaveUpdate() function in the microprogramming software for TOTOLINK T8 allows a hacker to execute arbitrary commands.

The vulnerability of the meshSlaveUpdate function in the microprogramming software for TOTOLINK T8 lies in the lack of measures taken to clean data at the control level when processing the serverIp parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2023-24152

A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2023-24152: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2023-24152

A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2022-25136

A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...

CVE-2022-25136: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet...