EUVD-2026-69203

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69206

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

PT-2026-84205

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the recv mesh info sync function allows unauthenticated attackers to force mesh configuration synchronization from a host under their control. This is achieved b...

PT-2026-84314

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the sendToMasterQosConfig function allows unauthenticated attackers to forward attacker-controlled Quality of Service QoS settings to the master. This is achieve...

CVE-2026-51748

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

CVE-2026-51763

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the csbroker component...

CVE-2026-51743

Incorrect access control in the guestwifisync function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69197

Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the csbroker component...

PT-2026-84222

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the delSlaveDevice function allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system. This is...

EUVD-2026-69204

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the csbroker component...

CVE-2026-51766

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the setDevReboot function. An unauthenticated, network-based attacker can send a crafted MQTT message to the cs_broker component to reboot the device. On a mesh master , the reboot command fans out to all me...

CVE-2026-51762

TOTOLINK T6 version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the meshInfoKick function. An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to kick or clean stale mesh information/state and trigger regeneration of mesh metadata. T...

CVE-2026-51763

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the csbroker component...

CVE-2026-51741

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84245

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the recvIndirectMeshInfo function allows unauthenticated attackers to insert or replace mesh neighbor records. This is achieved by sending a crafted MQTT message...

CVE-2026-51745

An incorrect access control flaw in the updatePriStaList function of the cs_broker component on TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows an unauthenticated, network-based attacker to refresh the primary station list by sending a crafted MQTT message. The CNA rates it CVSS 3.1 5.3 (Medi...

CVE-2026-51751

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the csbroker component...

CVE-2026-51757

CVE-2026-51757 is a critical access-control flaw (CVSS 9.8 ) in the TOTOLINK T6 mesh router, firmware 4.1.5cu.748_B20211015 . The meshSlaveUpdate function in the cs_broker component does not properly validate incoming requests, allowing an unauthenticated remote attacker to send a crafted MQTT me...

CVE-2026-51747

Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the csbroker component...

CVE-2026-51747

Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the csbroker component...