TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38591)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. There is an access control vulnerability in TOTOLINK T6. This vulnerability stems from improper access control in the meshSlaveUpgfw function. Attackers can exploit this vulnerability by sending a specially crafted MQTT message...

CVE-2026-51756: Improper Access Control

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component...