CVE-2026-51754: TOTOLINK T6 vulnerability
Published Sep 1, 2026
·Updated
Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the csbroker component.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Sep 1, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:17 PM
Description
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker needs to send a crafted MQTT message to the cs_broker component. No authentication is required.
2
What is the impact of successful exploitation?
An unauthenticated attacker can overwrite the device's slave IP inventory state through the updateSlaveIpList function.