The vulnerability is an incorrect access control in the keepAlive function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. It permits an unauthenticated attacker to emit indirect mesh heartbeat messages to the master router by sending a specially crafted MQTT message to the cs_broker component. Because the broker accepts these messages without verifying the sender, the attacker can effectively spoof heartbeat traffic, potentially disrupting mesh network coordination or elevating network privileges. This flaw is a classic improper access control issue (CWE‑284).

The affected product is TOTOLINK T6 running firmware 4.1.5cu.748_B20211015. No CNA vendor/product data were provided, but references indicate the device is available at the TOTOLINK website, and the issue appears specific to that firmware revision.

EPSS indicates a low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, requiring an attacker to connect to the device’s MQTT broker and send a specially crafted message that bypasses authentication. Because no public exploit is documented and no fix is currently published, the immediate risk is uncertain, but the potential impact of unauthorized credential bypass and mesh disruption warrants close monitoring and swift patching where possible.