CVE-2026-51760
Received Received - Intake

Incorrect Access Control in TOTOLINK T6 Firmware via MQTT Message

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: MITRE

Description
Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the cs_broker component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-51760
EUVD
EUVD-2026-69199

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
totolink t6 4.1.5cu.748_b20211015

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves incorrect access control in the informSyncUpgfw function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit it by sending a specially crafted MQTT message to the cs_broker component. This triggers mass firmware update activity across mesh slaves without proper authorization.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized MQTT messages sent to the cs_broker component on TOTOLINK T6 devices. Check for repeated firmware update triggers or unexpected mesh slave communications.

Impact Analysis

This vulnerability allows attackers to remotely initiate unauthorized firmware updates on connected devices. This could lead to device instability, potential denial of service, or even compromise of the entire mesh network. Users may experience unexpected downtime or loss of functionality in their networked devices.

Mitigation Strategies

Immediately isolate affected TOTOLINK T6 devices from the network. Disable unnecessary MQTT services on the device. Update to a patched firmware version if available. Monitor for unauthorized firmware update activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51760. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart