EUVD-2026-69205
GHSA-jr79-fg9q-6hgm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
MQTT mesh bus is realistically adjacent (AV:A) and unauthenticated; a write-only channel switch alters config (I:L) and disrupts Wi-Fi (A:L) with no data read (C:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the cs_broker component.
AnalysisAI
Unauthenticated mesh-channel manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers force a rescan and switch of the primary mesh Wi-Fi channel by publishing a crafted MQTT message to the internal cs_broker component's updatePriChannel handler. No credentials are required, and no public exploit is identified at time of analysis; EPSS is low (0.18%, 7th percentile), indicating limited observed exploitation interest despite the high CVSS score.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ability to reach the T6's internal cs_broker MQTT service and send it a crafted message invoking updatePriChannel; no authentication or user interaction is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) treats this as a full confidentiality/integrity/availability compromise, but the described action - rescanning and switching the primary mesh channel - is a write-only control operation with no data-read path, so confidentiality impact (C:H) is overstated; the realistic impact is integrity/availability disruption of the wireless service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched firmware version is identified at time of analysis; the referenced TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) should be monitored for a build newer than 4.1.5cu.748_B20211015, and the coordination trackers (https://github.com/DarkBoulder/CVE-Vendor-Coordination and https://github.com/ShengWu00/CVE-Vendor-Coordination TOTOLINK READMEs) watched for fix status. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all TOTOLINK T6 routers in your environment and confirm which are running firmware version 4.1.5cu.748_B20211015 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today