CVE-2026-51756

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015

Description Incorrect access control in the meshSlaveUpgfw() function allows unauthenticated attackers to initiate firmware flashing using existing upgrade files. This is achieved by sending a crafted MQTT message to the cs broker component. MQTT (Message Queuing Telemetry Transport) is a lightweight messaging protocol used for communication between devices.

Recommendations As a temporary workaround, restrict access to the cs broker component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.