CVE-2026-51769: n/a

This vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 arises from improper access control in the remoteCloudUpdateCheck function. An attacker without authentication can exploit this flaw by sending a specially crafted MQTT message to the cs_broker component, triggering a restart of the cloud update check workflow. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported as of the published date.

Successful exploitation allows an unauthenticated attacker to restart the cloud update check workflow on the affected device, potentially disrupting normal operation and impacting confidentiality, integrity, and availability of the device's update mechanism.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the MQTT service and monitor for suspicious MQTT messages targeting the cs_broker component to reduce exposure.