CVE-2026-51770

CRITICAL 9.8CVE-2026-51770 · Published 01/09/2026 · updated 02/09/2026

In short

CVE-2026-51770 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.64%, higher than 50.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the cs_broker component..

References

DarkBoulder/CVE-Vendor-Coordination
ShengWu00/CVE-Vendor-Coordination
totolink.net
totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free