CVE-2026-51745: n/a

This vulnerability arises from improper access control in the updatePriStaList function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. An attacker without authentication can send a specially crafted MQTT message to the cs_broker component, triggering a refresh of the primary station list. The CVSS 3.1 base score is 5.3 (medium), with no confidentiality or availability impact, but with integrity impact due to unauthorized modification of the station list. No patch or official remediation information is currently available, and no known exploits are reported in the wild.

The vulnerability allows an unauthenticated attacker to modify the primary station list by sending crafted MQTT messages, which impacts the integrity of the device's configuration. There is no direct confidentiality or availability impact reported. This could potentially lead to unauthorized changes in network behavior or device operation related to the station list.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to MQTT services and monitoring for suspicious MQTT traffic targeting the cs_broker component. No official fix or temporary workaround is currently documented.