An incorrect access control in TOTOLINK T6’s informSyncUpgfw function allows an attacker to send a crafted MQTT message to the cs_broker component without authentication. This enables the attacker to trigger firmware update activity on all mesh slave devices. The impact is that the attacker could install unauthorized firmware, potentially compromising device integrity, confidentiality, and availability.

This vulnerability affects TOTOLINK T6 devices running firmware version 4.1.5cu.748_B20211015. The issue is present in the cs_broker MQTT broker that facilitates communication among mesh devices. Only devices running this specific firmware version are impacted; earlier or later versions are not listed as affected.

Because the function lacks proper authentication, the attack vector is via MQTT traffic sent to the cs_broker, which may be reachable over local or remote networks. Exploitation requires only the ability to transmit an MQTT message to the broker; no elevated privileges are necessary. Though the EPSS score is <1% and the CVSS score is 9.8, and the vulnerability is not listed in KEV, the ability to mass‑trigger firmware updates across a mesh network represents a very high impact risk if discovered.