CVE-2026-51751

CRITICAL 9.8CVE-2026-51751 · Published 01/09/2026 · updated 03/09/2026

In short

CVE-2026-51751 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.64%, higher than 50.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the cs_broker component.

References

DarkBoulder/CVE-Vendor-Coordination
ShengWu00/CVE-Vendor-Coordination
totolink.net
totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free