CVE-2026-51766

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51745

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the csbroker component...

CVE-2026-51762

CVE-2026-51762 is an incorrect access control vulnerability in the meshInfoKick function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to kick or clean stale mesh information/state and trigger regener...

CVE-2026-51766

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51763

CVE-2026-51763 is an incorrect access control flaw in the freeStaClient function of the TOTOLINK T6 wireless router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to forcibly disconnect legitimate wireless clients, resultin...

EUVD-2026-69208

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the csbroker component...

CVE-2026-51741

An incorrect access control vulnerability in the clearDiagnosisLog function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to erase diagnosis logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The missing authorization check on this endpo...

CVE-2026-51742

CVE-2026-51742 is an incorrect access control flaw in the discoverWan function of the TOTOLINK T6 router, specifically in firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can trigger WAN discovery logic by sending a crafted POST request to the endpoint /cgi-bin/cstecgi.cgi, by...

CVE-2026-51743

An incorrect access control vulnerability in the guest_wifi_sync function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows unauthenticated attackers to disable guest virtual AP interfaces by sending a crafted MQTT message to the cs_broker component. The root cause is insufficient access con...

CVE-2026-51744

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) contains an incorrect access control flaw in the recv_mesh_info_sync function. An unauthenticated attacker can send a crafted MQTT message to the cs_broker component, forcing mesh configuration synchronization from an attacker-controlled host. The vul...

CVE-2026-51748

CVE-2026-51748 affects TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ). An incorrect access control flaw in the sendStaticInfoToMaster function allows unauthenticated attackers to update stored slave inventory records by sending a crafted MQTT message to the cs_broker component. The vulnerability i...

CVE-2026-51748

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

CVE-2026-51752

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the csbroker component...

CVE-2026-51754

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51757

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51760

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51763

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the csbroker component...

CVE-2026-51765

Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the csbroker component...

CVE-2026-51752

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) is affected by an incorrect access control flaw in the staticInfoSend function. An unauthenticated attacker can exploit this by sending a crafted MQTT message to the cs_broker component, which triggers static information reporting to the configured ma...

CVE-2026-51765

CVE-2026-51765 affects the TOTOLINK T6 mesh router on firmware 4.1.5cu.748_B20211015 . The root cause is an incorrect access control in the recvIndirectMeshInfo function, reachable through the cs_broker component. An unauthenticated attacker can send a crafted MQTT message to insert or replace me...