CVE-2026-51754: n/a

This vulnerability arises from improper access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015. An attacker without authentication can send a specially crafted MQTT message to the cs_broker component, which results in overwriting the slave IP inventory state. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation allows unauthenticated attackers to overwrite critical device state information related to slave IPs, potentially leading to full compromise of device functionality and network security. The impact affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to the MQTT service and monitoring for suspicious MQTT messages targeting the cs_broker component.