CVE-2026-51748: Improper Access Control

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

CVE-2026-51748

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the sendStaticInfoToMaster function. This vulnerability allows unauthenticated attackers to update stored slave inventory records by sending a crafted MQTT message to the cs_broker ...