An improper access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows an unauthenticated attacker to overwrite cloud-result tracking files by sending a crafted MQTT message to the cs_broker component. The capability to change these tracking files can corrupt the reported cloud status, leading to false environmental data or denial of service by manipulating device state.

The affected product is TOTOLINK T6 with firmware version 4.1.5cu.748_B20211015. The vulnerability resides in the MQTT handling code that bridges device status reporting to the cloud. No other vendor or product versions are listed in the CNA data.

Because no authentication is required to reach the vulnerable endpoint, the attack can be performed by any host that can connect to the MQTT broker on the device. The CVSS score of 9.8 indicates a critical impact, and the EPSS score of <1% suggests that exploitation is currently rare but could become more prominent as attackers become aware of the flaw. The lack of KEV listing does not diminish the need for immediate remediation, as the vulnerability allows an unauthenticated attacker to overwrite cloud-result tracking files, potentially leading to false status reporting or denial of service.