CVE-2026-51754

TOTOLINK T6 mesh router firmware 4.1.5cu.748_B20211015 contains an incorrect access control flaw (CWE-284) in the updateSlaveIpList function, which maintains the inventory of slave (extender) unit IP addresses. An unauthenticated attacker can trigger it by sending a crafted MQTT message to the device's cs_broker component, requiring no credentials and no user interaction, only network reachability to that service. Successful abuse lets the attacker overwrite the slave IP inventory state, potentially corrupting master-to-extender coordination or misrepresenting which devices are part of the mesh; the 9.8 CVSS score reflects high potential confidentiality, integrity, and availability impact. Owners running the affected T6 build are affected, with remote exposure limited to units whose MQTT broker is reachable from outside the local network. No public proof-of-concept or in-the-wild exploitation is known, the flaw is not in CISA's KEV, and EPSS estimates only a 0.4% probability of exploitation in the next 30 days.

What to do: No fixed version is available in the published data, so owners of T6 units on build 4.1.5cu.748_B20211015 should check TOTOLINK's support site for an updated firmware rather than assuming a patch exists. Until an update is available, avoid port-forwarding the device's MQTT broker port to the internet and restrict cs_broker reachability to trusted LAN segments. Check your firmware version on the router's administration page to confirm whether your unit runs the affected build.