CVE-2026-51747: TOTOLINK T6 vulnerability
Published Sep 1, 2026
·Updated
Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the csbroker component.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Sep 1, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·01:19 PM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker able to send a crafted MQTT message to the device's cs_broker component can exploit it. No prior authentication is required.
2
What capability does successful exploitation provide?
Successful exploitation allows the attacker to emit indirect mesh heartbeat information toward the master through the keepAlive function.
3
Which product version is identified as affected?
The reported affected version is TOTOLINK T6 4.1.5cu.748_B20211015.