CVE-2026-51767: TOTOLINK T6 vulnerability
Published Sep 1, 2026
·Updated
Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the csbroker component.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Sep 1, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The issue can be exploited without authentication by sending a crafted MQTT message to the cs_broker component.
2
What is the practical impact of successful exploitation?
An attacker can reset the device's pairing state and reboot the affected device.
3
Which firmware version is identified as affected?
The reported affected product and firmware version is TOTOLINK T6 4.1.5cu.748_B20211015.