T6

CVEs (178)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2022-25084	Totolink T6	Cri	0.66	9.8	0.25	Feb 24, 2022	TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVE-2022-38828	Totolink T6	Cri	0.65	9.8	0.20	Sep 16, 2022	TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi
CVE-2022-38827	Totolink T6	Cri	0.65	9.8	0.12	Sep 16, 2022	TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi
CVE-2026-51770	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the cs_broker component..
CVE-2026-51769	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51767	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51765	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51764	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51763	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51762	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51760	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51757	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51754	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51751	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51750	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51747	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51744	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51741	Totolink T6	Cri	0.64	9.8	0.01	Sep 1, 2026	Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51740	Totolink T6	Cri	0.64	9.8	0.01	Aug 31, 2026	Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51734	Totolink T6	Cri	0.64	9.8	0.01	Aug 31, 2026	Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2022-25084CriFeb 24, 2022
Totolink
T6
risk 0.66cvss 9.8epss 0.25
TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVE-2022-38828CriSep 16, 2022
Totolink
T6
risk 0.65cvss 9.8epss 0.20
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi
CVE-2022-38827CriSep 16, 2022
Totolink
T6
risk 0.65cvss 9.8epss 0.12
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi
CVE-2026-51770CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the cs_broker component..
CVE-2026-51769CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51767CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51765CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51764CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51763CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51762CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51760CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51757CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51754CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51751CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51750CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51747CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51744CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51741CriSep 1, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51740CriAug 31, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51734CriAug 31, 2026
Totolink
T6
risk 0.64cvss 9.8epss 0.01
Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Page 1 of 9