Access Control Vulnerability in TOTOLINK T6 by TOTOLINK
CVE-2026-51768

7.5HIGH

Key Information:

Vendor

TOTOLINK
Status
TOTOLINK T6
Vendor
CVE Published:
1 September 2026

What is CVE-2026-51768?

The vulnerability in the TOTOLINK T6 router arises from improper access controls in the setElinkQosConfig function, allowing an attacker to manipulate QoS policies on the master device. This exploitation is achievable when the attacker sends specially crafted MQTT messages to the cs_broker component, enabling unauthorized changes to network configurations. This flaw emphasizes the importance of secured access controls and device management in IoT and networking products.

References

https://www.totolink.net/home/menu/detail/menu_listtpl/do...
https://www.totolink.net/
https://github.com/DarkBoulder/CVE-Vendor-Coordination/bl...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.