CVE-2026-51760

CVE-2026-51760 is an incorrect access control flaw (CWE-284) in the informSyncUpgfw function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. Because this function does not require authentication, an unauthenticated attacker can send a crafted MQTT message to the cs_broker component and cause firmware update activity to be triggered across all mesh slave nodes at once. An attacker gains the ability to force coordinated firmware-update states on the mesh network, and the critical 9.8 CVSS score (high confidentiality, integrity and availability impact) suggests significant potential downstream impact, although no public proof-of-concept documents a concrete abuse chain. Affected parties are anyone operating a TOTOLINK T6 mesh system on the listed firmware version. No exploitation has been reported: the flaw is not in CISA KEV, no public PoC exists, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

What to do: Identify any TOTOLINK T6 units running firmware 4.1.5cu.748_B20211015 and apply TOTOLINK's patched firmware once a fixed release is published (no fixed version is documented yet). As an interim mitigation, prevent untrusted networks from reaching the device's MQTT/cs_broker service — do not expose it to the WAN and restrict LAN-side MQTT access to trusted clients. Monitor the mesh for coordinated firmware-update activity that was not initiated by an administrator.