EUVD-2026-69202

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51757

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51763

CVE-2026-51763 is an incorrect access control flaw in the freeStaClient function of the TOTOLINK T6 wireless router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to forcibly disconnect legitimate wireless clients, resultin...

CVE-2026-51766

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the setDevReboot function. An unauthenticated, network-based attacker can send a crafted MQTT message to the cs_broker component to reboot the device. On a mesh master , the reboot command fans out to all me...

CVE-2026-51754

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51743

Incorrect access control in the guestwifisync function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the csbroker component...

CVE-2026-51743

An incorrect access control vulnerability in the guest_wifi_sync function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows unauthenticated attackers to disable guest virtual AP interfaces by sending a crafted MQTT message to the cs_broker component. The root cause is insufficient access con...

CVE-2026-51769

CVE-2026-51769 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . The vulnerability is an incorrect access control in the remoteCloudUpdateCheck function, which interacts with the cs_broker component. An unauthenticated attacker can send a crafted MQTT message to trigger a re...

CVE-2026-51770

TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is affected by an incorrect access control vulnerability in the sendToMasterQosConfig function. An unauthenticated attacker can forward attacker-controlled QoS settings to the master by sending a crafted MQTT message to the cs_broker component. No spec...

CVE-2026-51751

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the csbroker component...

CVE-2026-51756

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component...

CVE-2026-51745

An incorrect access control flaw in the updatePriStaList function of the cs_broker component on TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows an unauthenticated, network-based attacker to refresh the primary station list by sending a crafted MQTT message. The CNA rates it CVSS 3.1 5.3 (Medi...

CVE-2026-51747

CVE-2026-51747 affects TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 . The vulnerability is an incorrect access control in the keepAlive function, allowing unauthenticated attackers to send a crafted MQTT message to the cs_broker component to emit indirect mesh heartbeat information ...

CVE-2026-51766

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51764

Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the csbroker component...

CVE-2026-51767

CVE-2026-51767 affects the TOTOLINK T6 (version 4.1.5cu.748_B20211015 ), an IoT device. An incorrect access control flaw in the recvClearPairCfg function of the cs_broker component allows an unauthenticated attacker to send a crafted MQTT message that resets the pairing state and reboots the devi...

CVE-2026-51757

CVE-2026-51757 is an incorrect access control vulnerability in the meshSlaveUpdate function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can trigger a firmware download or flash workflow on the slave device by sending a crafted MQTT message to the cs_broker ...

CVE-2026-51752

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69193

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69205

Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the csbroker component...