TOTOLINK T6 CVE-2026-51754

Exploitation requires the attacker to reach the TOTOLINK T6's internal MQTT broker (cs_broker) and publish a crafted message targeting updateSlaveIpList; no credentials, user interaction, or non-default settings are needed on the vulnerable function itself (PR:N/UI:N). The practical limiting factor is network exposure of the MQTT service: on a default home/SOHO deployment the broker serves the mesh backhaul/LAN and is not intended to be WAN-reachable, so real-world exploitation typically requires a foothold on the local/mesh network or a misconfiguration exposing the broker externally. Only firmware 4.1.5cu.748_B20211015 of the T6 is confirmed affected.

The supplied CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real impact. The described action is a write-only overwrite of the internal slave-IP inventory state - an integrity issue (I:H) with, at most, availability degradation of mesh routing (A:L); there is no confidentiality disclosure, so C:H is not justified. SSVC aligns with a serious-but-bounded picture: Exploitation 'none' observed, Automatable 'yes', Technical Impact 'total' - the last reflects full control of the targeted function rather than full device compromise. EPSS is low (0.17%, 7th percentile) and there is no KEV listing and no public PoC, so this is not evidence of widespread active exploitation; a mid-sized operator such as a municipal IT team running these routers should still patch promptly because the barrier to exploitation (unauthenticated, low-complexity MQTT reach) is minimal. The most important caveat is exposure: exploitation requires network reachability to the cs_broker MQTT service, which on a correctly firewalled home/SOHO deployment is not exposed to the WAN - verify whether the broker port is reachable before treating AV:N as internet-facing.

An attacker with network reachability to the router's MQTT broker (e.g., a device on the LAN, or a WAN-exposed broker) publishes a crafted MQTT message invoking updateSlaveIpList, overwriting the stored slave-IP inventory with attacker-chosen or garbage values. This desynchronizes the mesh's view of its slave nodes, disrupting coordination and routing. No authentication is required and no PoC is currently public.