TOTOLINK T6 CVE-2026-51764

Exploitation requires network reachability to the TOTOLINK T6's internal MQTT broker (cs_broker) and the ability to publish a crafted MQTT message to the recvSlaveCloudCheckStatus topic/handler; no credentials are needed (PR:N) and no user interaction is required. The primary limiting factor is that cs_broker is an internal mesh-coordination component typically bound to the LAN rather than the WAN, so remote Internet-based exploitation is only realistic where the broker is exposed on a routable interface - otherwise an attacker must first gain a foothold on the local/mesh network. The condition is specific: only firmware 4.1.5cu.748_B20211015 is named, and the MQTT broker service must be running and reachable.

The supplied CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but that appears overstated for the described behavior: the function overwrites cloud-result tracking files, which is a write/integrity action with no described confidentiality read and no confirmed code execution, so C:H (and likely A:H) is not well supported - a vector closer to integrity-only is more defensible. Real-world exploitability also depends heavily on reachability: MQTT/cs_broker is an internal component and is typically not exposed to the WAN by default, which realistically narrows AV:N to LAN-adjacent attackers even though the vector claims network scope. Supporting signals are modest - EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no weaponized PoC is present in the references (only VulDB and vendor-coordination writeups) - so this reads as a genuine but low-urgency access-control bug rather than a mass-exploited critical. Where the T6 does expose the broker on a routable interface, even a mid-sized municipal IT team in radom should patch or segment promptly, but for the typical LAN-only deployment this is a lower priority than the router's firmware-flash and WAN-config CVEs in the same batch.

An attacker on the same LAN (or on the WAN, if the router exposes the MQTT broker) connects to the T6's cs_broker and publishes a crafted MQTT message targeting recvSlaveCloudCheckStatus. The handler processes it without authentication and overwrites the cloud-result tracking files, corrupting the router's cloud-check state and potentially disrupting cloud-coordination logic. No public PoC is available, though the message format is documented in third-party coordination writeups.