EUVD-2026-69379
GHSA-86c4-6mm3-v64j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated MQTT trigger to cs_broker (AV:N/AC:L/PR:N/UI:N) but only restarts a workflow - no disclosure (C:N) and minor integrity/availability effect (I:L/A:L).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component.
AnalysisAI
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers restart the cloud update check workflow by sending a crafted MQTT message to the exposed cs_broker component. The remoteCloudUpdateCheck handler performs no authentication before acting on broker messages, so anyone able to reach the broker can repeatedly trigger the workflow. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ability to send MQTT messages to the TOTOLINK T6's cs_broker component on firmware 4.1.5cu.748_B20211015; no credentials or user interaction are needed because the remoteCloudUpdateCheck handler enforces no authorization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) and the 'Authentication Bypass' tag paint this as a critical full-compromise flaw, but the described behavior - restarting the cloud update check workflow - is a write-only trigger with no data disclosure and no code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched firmware version is identified in the provided data at time of analysis; monitor the TOTOLINK download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) and the vendor-coordination READMEs for an updated build superseding 4.1.5cu.748_B20211015. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all TOTOLINK T6 routers in your environment and disable MQTT broker access or implement strict network segmentation limiting broker connectivity to trusted internal systems only if MQTT is operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today