CVE-2026-51743

The TOTOLINK T6 wireless dual-band Mesh router (specifically version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control issue in the guest_wifi_sync function. An unauthenticated attacker can exploit this by sending a crafted MQTT message to the cs_broker component, which allows ...

CVE-2026-51750

Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the csbroker component...

CVE-2026-51752

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the csbroker component...

CVE-2026-51754

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control vulnerability in the updateSlaveIpList function. This flaw allows unauthenticated attackers to overwrite the slave IP inventory state by sending a crafted MQTT message to the cs_broker compon...

CVE-2026-51757

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51756

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component...

CVE-2026-51757

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the meshSlaveUpdate function. An unauthenticated attacker can trigger a firmware download or flash workflow on a slave device by sending a crafted MQTT message to the cs_broker comp...

CVE-2026-51763

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the csbroker component...

CVE-2026-51762

Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the csbroker component...

CVE-2026-51766

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51760

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51760

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the informSyncUpgfw() function. Unauthenticated attackers can exploit this by sending a crafted MQTT message to the cs_broker component. This allows th...

CVE-2026-51762

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the meshInfoKick function. An unauthenticated attacker can exploit this by sending a crafted MQTT message to the cs_broker component. This allows the attac...

CVE-2026-51761

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , contains an incorrect access control vulnerability in the updateLanIp function. This flaw allows unauthenticated attackers to refresh the LAN address state by sending a crafted MQTT message to the cs_broker component. No spe...

EUVD-2026-69196

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69197

Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69199

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69198

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69205

Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69209

Incorrect access control in the recvmeshinfosync function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the csbroker component...