TOTOLINK T6 EUVD-2026-69197

Exploitation requires network reachability to the TOTOLINK T6's internal cs_broker MQTT component and the ability to publish a crafted MQTT message invoking the meshInfoKick handler; no authentication, credentials, or user interaction are needed (PR:N/UI:N). The practical limiting factor is broker exposure: if cs_broker is bound only to the mesh backhaul or LAN rather than the WAN, the attacker must be on-network (adjacent) rather than truly remote, which materially reduces real-world reach despite the AV:N rating. It applies to firmware 4.1.5cu.748_B20211015; other firmware builds are unconfirmed from the available data.

The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) and the SSVC signals (Automatable: yes, Technical Impact: total) paint a critical picture, but the signals conflict with the described behavior and should be reconciled before treating the raw score at face value. The described impact - kicking/cleaning mesh state and forcing metadata regeneration - is a write/state-manipulation operation that maps to integrity and availability disruption (mesh churn, transient loss of mesh connectivity), not confidentiality; the C:H component appears overstated because the function does not read or return sensitive data. Practically, exposure hinges entirely on whether the cs_broker MQTT endpoint is reachable from the attacker's network position: if the broker is bound only to the mesh backhaul/LAN, this is a LAN/adjacent risk rather than a true internet-facing AV:N issue, so the operator managing a mid-sized deployment should verify broker exposure before assuming remote reachability. SSVC lists Exploitation as 'none' and EPSS is low (0.18%), consistent with no known in-the-wild activity, so this is better characterized as a high-severity-but-low-current-exploitation issue warranting prompt patching rather than emergency response.

An attacker who can reach the T6's cs_broker MQTT service - for example a device on the same LAN/mesh segment, or a remote attacker if the broker is inadvertently exposed - publishes a crafted MQTT message invoking meshInfoKick without any credentials. The router clears stale mesh state and regenerates mesh metadata, and by repeating the action the attacker induces continual mesh churn and connectivity disruption. No public exploit code is identified at time of analysis, but AC:L and 'Automatable: yes' indicate the action is trivially scriptable once broker reachability exists.