PT-2026-84205

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the recv mesh info sync function allows unauthenticated attackers to force mesh configuration synchronization from a host under their control. This is achieved b...

CVE-2026-51743

Incorrect access control in the guestwifisync function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the csbroker component...

CVE-2026-51743

Incorrect access control in the guestwifisync function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the csbroker component...

PT-2026-84206

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the cs broker component...

PT-2026-84314

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the sendToMasterQosConfig function allows unauthenticated attackers to forward attacker-controlled Quality of Service QoS settings to the master. This is achieve...

CVE-2026-51767

Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the csbroker component...

PT-2026-84313

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs broker component...

EUVD-2026-69204

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the csbroker component...

PT-2026-84222

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the delSlaveDevice function allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system. This is...

CVE-2026-51752

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69203

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the csbroker component...

PT-2026-84223

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the cs broker component...

CVE-2026-51752

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the csbroker component...

CVE-2026-51760

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51741

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the clearDiagnosisLog function. This vulnerability allows unauthenticated attackers to erase diagnosis logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi e...

CVE-2026-51766

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the setDevReboot function. This vulnerability allows unauthenticated attackers to reboot the local device. Furthermore, on a master device, an attacker can fan out reboot commands t...

CVE-2026-51763

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is susceptible to an incorrect access control vulnerability within the freeStaClient function. This flaw allows unauthenticated attackers to forcibly disconnect wireless clients by transmitting a crafted MQTT message to the ...

CVE-2026-51748

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control vulnerability in the sendStaticInfoToMaster function. This flaw allows unauthenticated attackers to update stored slave inventory records by sending a crafted MQTT message to the cs_broker co...

CVE-2026-51762

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control vulnerability in the meshInfoKick function. An unauthenticated attacker can exploit this by sending a crafted MQTT message to the cs_broker component. This allows the attacker to kick or clea...

CVE-2026-51742

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw within the discoverWan function. An unauthenticated attacker can trigger the WAN discovery logic by sending a crafted POST request to the ** /cgi-bin/cstecgi.cgi** endpoint. ...