Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start firmware… (CVE-2026-51756)

CVE-2026-51756 is an access control vulnerability in the meshSlaveUpgfw function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. Unauthenticated attackers can exploit this flaw by sending a specially crafted MQTT message to the cs_broker component, triggering unauthorized firmware flashing using existing upgrade files. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). No official patch or remediation information is provided, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to start firmware flashing on the affected device, potentially leading to unauthorized disclosure of information (high confidentiality impact). There is no direct impact on integrity or availability according to the CVSS vector. This could undermine device security by enabling unauthorized firmware operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to MQTT services and monitor for suspicious MQTT messages targeting the cs_broker component to reduce exposure.