CVE-2026-51745: Medium severity TOTOLINK T6 vulnerability
Published Sep 1, 2026
·Updated
Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the csbroker component.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Sep 1, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·01:19 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
An attacker does not need to authenticate. Exploitation requires sending a crafted MQTT message to the device's cs_broker component.
2
Which device version is identified as affected?
The issue is identified in TOTOLINK T6 firmware version 4.1.5cu.748_B20211015.
3
What action can an attacker perform if exploitation succeeds?
An attacker can refresh the primary station list through the updatePriStaList function.