CVE-2026-51762: n/a

This vulnerability arises from improper access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015. An unauthenticated attacker can exploit this by sending a specially crafted MQTT message to the cs_broker component, enabling them to forcibly remove or reset mesh network state information. The flaw impacts confidentiality, integrity, and availability, as indicated by the CVSS 3.1 base score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to manipulate mesh network state by kicking or cleaning stale mesh information and forcing regeneration of mesh metadata. This can lead to disruption of network availability, loss of data integrity, and potential exposure of sensitive mesh network information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to MQTT broker components and monitor for suspicious MQTT messages targeting the cs_broker component to reduce risk.