CVE-2026-51761: TOTOLINK T6 vulnerability
Published Sep 1, 2026
·Updated
Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the csbroker component.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Sep 1, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:17 PM
Description
Frequently Asked Questions
1
What must an attacker be able to do to exploit this issue?
The attacker must be able to send a crafted MQTT message to the device's cs_broker component. No authentication is required.
2
Which systems are known to be affected?
The affected product identified in the available data is TOTOLINK T6 firmware version 4.1.5cu.748_B20211015.
3
What action can an attacker perform?
An unauthenticated attacker can refresh the device's LAN address state through the updateLanIp function. The available information does not establish further impact beyond that state refresh.