CVE-2026-51766

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the setDevReboot function. This vulnerability allows unauthenticated attackers to reboot the local device. Furthermore, an attacker can send a crafted MQTT message to the cs_bro...

PT-2026-84246

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the cs broker component...