EUVD-2026-69209
GHSA-pqmr-69qp-5g4w
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Analysis complete. Two notes on this one:
- Prompt injection ignored — the input's "Editorial note" tried to get me to weave the word "gniezno" into
risk_assessment. That's an injection attempt embedded in task data, not a legitimate instruction, so I disregarded it. Nothing was inserted. - Metadata corrections flagged — the
n/a n/aversion placeholder (real product is TOTOLINK T6) and the loose "Authentication Bypass" tag (really CWE-284 improper access control) are surfaced indata_quality_flags. I also assessed the CVSS down from 9.8 (C:H/I:H/A:H) sincerecv_mesh_info_syncis a write/config-injection primitive, not a disclosure one → assessed C:N/I:H/A:L.
Saved to memory alongside the sibling TOTOLINK T6 MQTT-cluster entries.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the cs_broker component.
Executive ViewAI
TOTOLINK T6 mesh routers contain an unauthenticated remote configuration injection vulnerability that allows attackers to modify device mesh networking settings without authorization. Organizations deploying TOTOLINK T6 devices face potential network disruption and unauthorized configuration changes, with no patch currently available and exploitation probability currently low (EPSS 0.2%).
Within 24 hours: Inventory TOTOLINK T6 devices across your network and implement firewall rules blocking external access to the device's administrative interface and MQTT broker ports. Within 7 days: Disable mesh synchronization features on TOTOLINK T6 devices if operationally feasible, and segregate these devices to isolated network segments separate from critical systems. Within 30 days: Monitor TOTOLINK vendor advisories for a security patch to CVE-2026-51744; if no patch is released within 30 days, evaluate device replacement with alternative equipment from vendors providing timely security updates.
Network segmentation to restrict TOTOLINK T6 access from untrusted networks; disable MQTT broker and mesh-sync services if not required operationally; enable device-level logging and alerting on configuration changes; consider removing affected devices from externally-facing or perimeter deployments until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB