TOTOLINK T6 CVE-2026-51770

Exploitation requires network reachability to the T6's internal MQTT broker (the cs_broker component) and the ability to publish a crafted MQTT message to the sendToMasterQosConfig topic/handler; no credentials, user interaction, or non-default feature toggles are described (PR:N/UI:N). The practical limiting factor is broker reachability: cs_broker is an internal mesh/cluster service, so exploitation is realistic for an attacker on the LAN, guest, or mesh segment, or against a device whose broker port is exposed to the WAN - a remote Internet attacker only qualifies if that port is externally reachable. Affected build is specifically firmware 4.1.5cu.748_B20211015 on the TOTOLINK T6.

The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) overstates real-world impact: the described action is forwarding attacker-controlled QoS settings, which is a write/config-tampering primitive affecting integrity (and marginally availability via traffic degradation), not a disclosure of sensitive data - so C:H is not justified by the description; a more defensible impact is C:N/I:H/A:L. The MITRE-sourced CVSS network vector is also optimistic in practice: MQTT/cs_broker is typically an internal LAN/mesh service, so 'network' exploitation usually presumes the attacker already has L2/LAN reachability to the broker rather than arbitrary Internet access, unless the broker port is exposed on WAN. EPSS is low (0.18%, 7th percentile) and there is no KEV listing and no identified public PoC, so this reads as a genuine unauthenticated-config-tampering weakness that is nonetheless a low-urgency, targeted-risk item rather than a mass-exploited emergency. Because the flaw requires no credentials and can degrade or manipulate network traffic prioritization for every device behind the router, any operator running affected T6 units on an untrusted or bridged segment should still remediate promptly. The 'Authentication Bypass' tag is a loose fit - this is missing access control on an unauthenticated handler rather than a bypass of an existing auth mechanism.

An attacker on the same LAN/Wi-Fi segment (or reaching an internet-exposed broker) crafts and publishes an MQTT message to the T6's cs_broker targeting the sendToMasterQosConfig handler with malicious QoS parameters. The master node accepts and applies the settings without authenticating the sender, letting the attacker reshape or degrade traffic prioritization for downstream clients. No public PoC is currently identified, but the low complexity (AC:L) and lack of authentication make weaponization straightforward for an attacker with broker reachability.