CVE-2026-51769: TOTOLINK T6 vulnerability
Published Sep 1, 2026
·Updated
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component.
Affected Software
1 affected component
TOTOLINK T6=4.1.5cu.748_B20211015
Event History
Sep 1, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What must an attacker be able to do to trigger the vulnerable workflow?
The attacker must be able to send a crafted MQTT message to the device's cs_broker component. No authentication is required for the described attack.
2
What operational effect is described?
An attacker can restart the cloud update check workflow. The provided information does not state that firmware can be installed, modified, or otherwise controlled through this issue.
3
Which device and firmware version are identified as affected?
The affected product identified in the available data is TOTOLINK T6 running firmware 4.1.5cu.748_B20211015.