CVE-2026-51757

CVE-2026-51757 is an incorrect access control flaw (CWE-284) in the meshSlaveUpdate function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can send a crafted MQTT message to the device's cs_broker component, causing the slave (satellite) node of the mesh network to start a firmware download or a flash workflow. Because the flash process can be triggered with no authentication or user interaction, an attacker who can reach the broker could potentially install attacker-supplied firmware and fully compromise the slave node, consistent with the 9.8 CVSS score. Affected users are those running the TOTOLINK T6 mesh Wi-Fi system on the listed firmware, where the cs_broker service is reachable from the local network or from the internet if remote management is exposed. There is currently no public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS estimates only a 0.4% probability of exploitation in the next 30 days, so no exploitation is known.

What to do: Check your T6 firmware version and upgrade as soon as TOTOLINK publishes a fixed release (no fixed version is listed in the available data, so monitor vendor advisories). Until then, keep the T6's management interface and MQTT/cs_broker service off the WAN (disable remote/WAN management) and restrict which clients can reach the device on the LAN, e.g., by separating guest and IoT traffic. Treat any slave node as potentially compromised if untrusted clients had network access, and re-flash it from a trusted image once a patch is available.