CVE-2026-51743: TOTOLINK T6 Authentication Bypass Vulnerability

CVE-2026-51743 Overview

CVE-2026-51743 is an incorrect access control vulnerability in the guest_wifi_sync function of the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can disable guest virtual access point (AP) interfaces by sending a crafted MQTT message to the cs_broker component. The flaw is tracked under CWE-284: Improper Access Control and exposes network-reachable devices to remote tampering without any credentials or user interaction.

Critical Impact
Remote unauthenticated attackers can disrupt guest Wi-Fi service on affected TOTOLINK T6 routers by sending crafted MQTT messages to the broker component.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
Devices exposing the cs_broker MQTT component to reachable networks

Discovery Timeline

2026-09-01 - CVE-2026-51743 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51743

Vulnerability Analysis

The TOTOLINK T6 router exposes an MQTT (Message Queuing Telemetry Transport) service through its cs_broker component. This broker processes messages that trigger internal functions, including guest_wifi_sync. The function lacks proper access control checks and accepts requests without verifying the sender's identity or authorization state.

An attacker who can reach the broker over the network can publish a crafted MQTT message that invokes guest_wifi_sync to disable the guest virtual AP interface. This results in loss of guest Wi-Fi availability and integrity of the router's wireless segmentation configuration. Because the affected code path serves an administrative function, exposing it to unauthenticated clients breaks the router's segmentation model between guest and administrative planes.

Root Cause

The root cause is missing authorization enforcement in the guest_wifi_sync handler within the cs_broker MQTT message dispatcher. The function trusts incoming MQTT publish messages and executes privileged wireless configuration changes without validating the client's identity, token, or role. This aligns with the CWE-284 classification of Improper Access Control.

Attack Vector

Exploitation is performed over the network by publishing an MQTT message to the router's cs_broker component. No authentication or user interaction is required. The attacker connects to the exposed MQTT service, sends a crafted payload targeting the guest_wifi_sync topic or command handler, and triggers deactivation of the guest virtual AP interface.

Details on the specific message format are referenced in the disclosure repositories. See the DarkBoulder TOTOLINK coordination notes and the ShengWu00 TOTOLINK coordination notes for additional technical context.

Detection Methods for CVE-2026-51743

Indicators of Compromise

Unexpected disabling of the guest virtual AP interface on TOTOLINK T6 devices
MQTT publish messages arriving at the cs_broker component from untrusted sources
Wireless configuration changes not initiated by an administrator
Guest client disconnections coinciding with inbound MQTT traffic

Detection Strategies

Monitor the router's management interface and logs for state changes to the guest AP interface
Inspect network flows for MQTT traffic (default TCP port 1883 or TLS 8883) directed at TOTOLINK T6 devices from unexpected sources
Alert on repeated MQTT connections to cs_broker from clients that have not been provisioned as legitimate management endpoints

Monitoring Recommendations

Capture and baseline MQTT traffic on network segments hosting the router
Log every configuration change event emitted by the router and forward to a centralized store
Correlate guest Wi-Fi service disruptions with inbound broker traffic to identify triggering events

How to Mitigate CVE-2026-51743

Immediate Actions Required

Restrict network access to the MQTT cs_broker service so it is not reachable from untrusted or guest network segments
Place TOTOLINK T6 devices behind a firewall that blocks inbound connections to MQTT ports (1883, 8883) from unauthorized hosts
Audit current router configurations and verify the guest AP interface state matches the intended baseline
Monitor the TOTOLINK firmware download page for a security update addressing this issue

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for firmware 4.1.5cu.748_B20211015. Administrators should track vendor advisories on the TOTOLINK official website and apply firmware updates as soon as a fix becomes available.

Workarounds

Segment the router's management network from guest and general user networks using VLANs or physical isolation
Block inbound MQTT ports at the network perimeter and on any upstream firewall
Disable remote management features that expose the cs_broker component beyond the local administrative segment
Replace affected devices with alternative hardware if the router must be exposed to untrusted networks and no patch is available

bash

# Example: Block inbound MQTT traffic to the router at an upstream Linux firewall
# Replace ROUTER_IP with the TOTOLINK T6 management address
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 1883 -j DROP
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 8883 -j DROP