CVE-2026-51770

Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the csbroker component...

CVE-2026-51769

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...

CVE-2026-51768

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51767

Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51766

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51761

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51765

Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the csbroker component...

CVE-2026-51756

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component...

CVE-2026-51748

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

CVE-2026-51752

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the csbroker component...

CVE-2026-51745

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the csbroker component...

CVE-2026-51743

Incorrect access control in the guestwifisync function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the csbroker component...

CVE-2026-51742

Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51763

CVE-2026-51763 is an incorrect access control flaw in the freeStaClient function of the TOTOLINK T6 wireless router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to forcibly disconnect legitimate wireless clients, resultin...

CVE-2026-51748

CVE-2026-51748 is an incorrect access control vulnerability in the sendStaticInfoToMaster function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to update stored slave inventory records, achieving a h...

EUVD-2026-69204

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69206

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

CVE-2026-51742

TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the discoverWan function. An unauthenticated attacker can trigger WAN discovery logic by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 5.9 (MEDIUM) with a H...

CVE-2026-51744

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) contains an incorrect access control flaw in the recv_mesh_info_sync function. An unauthenticated attacker can send a crafted MQTT message to the cs_broker component, forcing mesh configuration synchronization from an attacker-controlled host. The vul...

EUVD-2026-69202

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the csbroker component...