What is the CVSS score of CVE-2026-51744?

CVE-2026-51744 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-51744?

Within 24 hours: Inventory TOTOLINK T6 devices across your network and implement firewall rules blocking external access to the device's administrative interface and MQTT broker ports. Within 7 days: Disable mesh synchronization features on TOTOLINK T6 devices if operationally feasible, and segregate these devices to isolated network segments separate from critical systems. Within 30 days: Monitor TOTOLINK vendor advisories for a security patch to CVE-2026-51744; if no patch is released within 30 days, evaluate device replacement with alternative equipment from vendors providing timely security updates.

CVE-2026-51744

EUVD-2026-69209 CRITICAL

Improper Access Control (CWE-284)

2026-09-01 cve@mitre.org

GHSA-pqmr-69qp-5g4w

Authentication Bypass

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 02, 2026 - 20:38 vuln.today

CVSS changed

Sep 02, 2026 - 18:22 NVD

9.8 (CRITICAL)

CVE Published

Sep 01, 2026 - 13:19 cve.org

CRITICAL 9.8

CVE Published

Sep 01, 2026 - 13:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the cs_broker component.

AnalysisAI

Analysis complete. Two notes on this one: 1. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Inventory TOTOLINK T6 devices across your network and implement firewall rules blocking external access to the device's administrative interface and MQTT broker ports. …

Threat intelligence, references, and detailed analysis are available after sign-in.