TOTOLINK T6 EUVD-2026-69194

Exploitation requires network reachability to the TOTOLINK T6's cs_broker MQTT component and the ability to publish a crafted MQTT message to the recvIndirectMeshInfo handler; no authentication, no user interaction, and no special device configuration are needed on affected firmware 4.1.5cu.748_B20211015 (CVSS PR:N/UI:N). The key limiting factor is broker reachability: MQTT bus/mesh-coordination services on such devices are frequently bound to the LAN or inter-node network rather than the WAN, so attackers typically need a foothold on the local/mesh network unless the device exposes cs_broker on its WAN interface. Impact is limited to inserting/replacing mesh neighbor records (integrity), not reading device secrets.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) signals trivially exploitable, unauthenticated, high-impact - but the signals conflict when weighed together. EPSS is only 0.18% (7th percentile) and there is no KEV listing and no identified public PoC, indicating no observed or imminent mass exploitation. More importantly, the described action - inserting/replacing mesh neighbor records - is a write/integrity operation; it does not read sensitive data (so C:H is overstated) and does not directly crash the device (A:H is at most indirect via mesh disruption). Realistic exploitability also depends on reachability of cs_broker: MQTT is typically an internal/LAN-side or inter-node bus, so 'AV:N against the WAN' should be verified against the actual deployment. Net: a genuine unauthenticated integrity flaw worth patching on exposed devices, but the 9.8 headline overstates confidentiality/availability and the low EPSS argues against emergency prioritization absent evidence of WAN exposure.

An attacker who can reach the router's cs_broker MQTT endpoint - for example another host on the LAN, a compromised IoT device, or the WAN interface if the broker is exposed - publishes a crafted MQTT message to the recvIndirectMeshInfo handler without any credentials. The message inserts or overwrites mesh neighbor records, poisoning the router's view of the mesh topology to redirect or disrupt inter-node traffic. No public PoC is currently identified, and the low CVSS attack complexity means a single crafted message suffices once the broker is reachable.