CVE-2026-51744 Overview
CVE-2026-51744 is an incorrect access control vulnerability in the recv_mesh_info_sync function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw resides in the cs_broker component, which processes Message Queuing Telemetry Transport (MQTT) messages without validating the sender. Unauthenticated attackers can send a crafted MQTT message to force mesh configuration synchronization from an attacker-controlled host. This allows adversaries to overwrite legitimate mesh configuration data on the target device. The vulnerability is classified under CWE-284 (Improper Access Control).
Critical Impact
Unauthenticated remote attackers can hijack mesh configuration on TOTOLINK T6 routers by injecting crafted MQTT messages into the cs_broker component, compromising confidentiality, integrity, and availability of the device.
Affected Products
- TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015
- The cs_broker MQTT component handling mesh synchronization
- Devices running the vulnerable recv_mesh_info_sync function
Discovery Timeline
- 2026-09-01 - CVE-2026-51744 published to the National Vulnerability Database
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-51744
Vulnerability Analysis
The TOTOLINK T6 uses MQTT to coordinate mesh networking between nodes. The cs_broker component receives synchronization messages and dispatches them to handlers such as recv_mesh_info_sync. This handler processes mesh configuration payloads that determine how the device joins and trusts other mesh peers.
The vulnerable handler does not verify whether the MQTT publisher is an authorized mesh peer. Any host able to reach the broker can publish crafted synchronization messages. The device then treats the attacker-controlled host as an authoritative source of mesh configuration data.
Successful exploitation allows attackers to redirect mesh trust relationships, alter routing configuration, and pivot into the internal network fabric governed by the device.
Root Cause
The root cause is missing authentication and authorization checks in the MQTT message handling path. The recv_mesh_info_sync function accepts synchronization payloads based on topic subscription alone. It does not validate identity, session state, or cryptographic proof of the publisher, which maps directly to [CWE-284] Improper Access Control.
Attack Vector
Exploitation requires network reachability to the MQTT broker running on the TOTOLINK T6 device. An attacker publishes a crafted MQTT message on the mesh synchronization topic consumed by cs_broker. The device parses the payload and invokes recv_mesh_info_sync, applying attacker-supplied configuration without validation. No user interaction or prior credentials are required.
No verified public proof-of-concept code is available. See the vendor coordination documentation on GitHub for coordination details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-51744
Indicators of Compromise
- Unexpected MQTT PUBLISH messages targeting mesh synchronization topics on TOTOLINK T6 devices from unknown hosts
- Sudden changes to mesh peer lists, routing tables, or trusted node identifiers on the router
- Outbound connections from the router to previously unseen hosts following an MQTT message burst
Detection Strategies
- Inspect MQTT traffic on the local network for unauthenticated publishers targeting the cs_broker topic namespace
- Correlate router configuration change events with the source of the triggering MQTT message
- Baseline legitimate mesh peers and alert when synchronization messages originate from IPs outside that baseline
Monitoring Recommendations
- Log all MQTT connections to TOTOLINK T6 devices, including client identifiers and source addresses
- Monitor for anomalous mesh configuration changes and unexpected reboots on affected routers
- Segment router management and mesh traffic onto isolated VLANs and alert on cross-segment MQTT traffic
How to Mitigate CVE-2026-51744
Immediate Actions Required
- Restrict network access to TOTOLINK T6 devices so only trusted mesh peers can reach the MQTT broker port
- Isolate affected routers on a management VLAN and block untrusted hosts from reaching the cs_broker service
- Audit existing mesh configuration on affected devices to confirm no unauthorized peers have been added
Patch Information
No vendor patch has been published in the referenced advisories at the time of writing. Consult the TOTOLINK download page and the TOTOLINK official website for firmware updates addressing CVE-2026-51744.
Workarounds
- Disable mesh networking functionality on TOTOLINK T6 devices where the feature is not required
- Enforce network-layer access control lists that permit MQTT traffic only from known mesh peer addresses
- Place affected devices behind a firewall that blocks inbound access to MQTT ports from untrusted networks
# Example firewall rule restricting MQTT access to trusted peers
iptables -A INPUT -p tcp --dport 1883 -s <trusted_mesh_peer_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
