CVE-2026-51756: TOTOLINK T6 vulnerability
Published Sep 1, 2026
·Updated
Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Sep 1, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:17 PM
Description
Frequently Asked Questions
1
What access does an attacker need to trigger the firmware flashing operation?
The attacker does not need to authenticate. Exploitation requires sending a crafted MQTT message to the cs_broker component.
2
What firmware image can be flashed through this issue?
The issue allows firmware flashing to be started using existing upgrade files. The provided information does not indicate that an attacker can supply a new firmware image.
3
How can defenders determine whether a device is exposed?
Devices identified as TOTOLINK T6 running firmware 4.1.5cu.748_B20211015 are affected. Exposure also depends on whether the cs_broker component can receive attacker-crafted MQTT messages.