CVE-2026-51751: n/a

This vulnerability arises from improper access control in the delSlaveDevice function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. An attacker without authentication can exploit this flaw by sending a specially crafted MQTT message to the cs_broker component, which triggers removal of a slave device from the local mesh management data and causes the system to reboot. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to remove devices from the mesh network management data and reboot the affected device, resulting in potential denial of service and disruption of network operations. The attacker gains high impact on confidentiality, integrity, and availability as per the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict network access to the MQTT broker component and monitor for suspicious MQTT messages if possible.