CVE-2026-51752: TOTOLINK T6 vulnerability
Published Sep 1, 2026
·Updated
Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the csbroker component.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Sep 1, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What must an attacker be able to reach to exploit this issue?
An attacker needs to be able to send a crafted MQTT message to the device's cs_broker component. The issue is exploitable without authentication.
2
What action can an attacker cause?
The attacker can trigger the device's static information reporting function, causing it to report static information to the configured master.
3
Which product version is identified as affected?
The reported affected version is TOTOLINK T6 4.1.5cu.748_B20211015.