TOTOLINK T6 CVE-2026-51769

Requires the ability to send MQTT messages to the TOTOLINK T6's cs_broker component on firmware 4.1.5cu.748_B20211015; no credentials or user interaction are needed because the remoteCloudUpdateCheck handler enforces no authorization. The key limiting factor is network reachability of cs_broker: exploitation is only remote/unauthenticated to the extent the MQTT broker is accessible to the attacker, which in typical deployments may be LAN- or mesh-scoped rather than internet-facing. Impact is bounded to restarting the cloud update check workflow - no data is read and no code is executed.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) and the 'Authentication Bypass' tag paint this as a critical full-compromise flaw, but the described behavior - restarting the cloud update check workflow - is a write-only trigger with no data disclosure and no code execution. The C:H/I:H/A:H rating is therefore substantially overstated; realistic impact is a minor state change and possible workflow churn (assessed C:N/I:L/A:L). The exploitation ceiling is a repeated-trigger nuisance, not takeover. Corroborating this, EPSS is only 0.18% (7th percentile), the CVE is not on CISA KEV, and no public POC is referenced. Note also that MQTT/cs_broker reachability may in practice be LAN- or mesh-scoped rather than truly internet-facing; the AV:N assumption should be verified against the device's default broker exposure. Net: real-world priority is low-to-moderate despite the headline 9.8.

An attacker on a network path to the router's cs_broker (e.g., the LAN, an adjacent mesh segment, or the WAN if the broker is exposed) publishes a crafted MQTT message targeting the remoteCloudUpdateCheck handler. Because no authentication is enforced, the router restarts its cloud update check workflow on demand; repeating the message causes redundant workflow churn. No POC is referenced, and the practical outcome is a nuisance-level trigger rather than device compromise.