CVE-2026-51745: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51745 Overview

CVE-2026-51745 is an incorrect access control vulnerability in the updatePriStaList function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to refresh the primary station list by sending a crafted Message Queuing Telemetry Transport (MQTT) message to the cs_broker component. The weakness is tracked under CWE-284: Improper Access Control and affects the router's internal messaging bus.

Critical Impact
Unauthenticated attackers with network access to the cs_broker MQTT interface can manipulate the primary station list on affected TOTOLINK T6 devices, impacting the integrity of client tracking on the router.

Affected Products

TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015
cs_broker MQTT component on the affected firmware
updatePriStaList function within the T6 management stack

Discovery Timeline

2026-09-01 - CVE-2026-51745 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in the NVD database

Technical Details for CVE-2026-51745

Vulnerability Analysis

The vulnerability resides in the updatePriStaList function exposed through the cs_broker component on TOTOLINK T6 devices. The cs_broker service acts as an MQTT broker used for internal control messages between router subsystems. The updatePriStaList handler processes messages that refresh the primary station list, which tracks associated wireless clients.

The handler does not validate whether the publisher of the MQTT message is authenticated or authorized. Any client capable of publishing to the broker's topic can trigger the list refresh operation. Because the flaw is limited to refreshing state data, its measurable impact is on integrity of the station list rather than confidentiality or availability of the device.

Root Cause

The root cause is missing access control enforcement in the updatePriStaList message handler. The cs_broker component accepts and dispatches control messages without verifying the identity or privilege level of the sender. This design places sensitive state-modifying operations behind an unauthenticated channel, which maps directly to CWE-284.

Attack Vector

An attacker reachable on the network path to the cs_broker MQTT endpoint can craft an MQTT publish message targeting the topic consumed by updatePriStaList. The router processes the message and refreshes the primary station list without authenticating the request. No user interaction is required, and no credentials are needed to trigger the behavior.

No verified public proof-of-concept code is currently associated with this CVE. Technical coordination notes are available in the DarkBoulder CVE Coordination repository and the ShengWu00 CVE Coordination repository.

Detection Methods for CVE-2026-51745

Indicators of Compromise

Unexpected MQTT PUBLISH packets destined for the cs_broker component on TOTOLINK T6 devices from unrecognized clients
Frequent or anomalous refreshes of the primary station list without corresponding administrative activity
MQTT sessions originating from external or non-management network segments toward the router

Detection Strategies

Inspect network traffic for MQTT packets targeting the router's broker port and correlate them with authorized management sources
Baseline the frequency of primary station list updates and alert on statistical deviations
Enable device-side logging for cs_broker message handling where firmware permits, and forward logs to a centralized platform for review

Monitoring Recommendations

Aggregate router syslog and MQTT broker events into a SIEM or data lake for longitudinal analysis
Monitor wireless client association tables for churn patterns that do not match physical client behavior
Track publish activity by source IP against an allow list of authorized management hosts

How to Mitigate CVE-2026-51745

Immediate Actions Required

Restrict network access to the cs_broker MQTT service by placing the router management interface on an isolated VLAN or management network
Block inbound MQTT traffic from untrusted networks and the internet to affected TOTOLINK T6 devices
Inventory TOTOLINK T6 deployments and identify units running firmware 4.1.5cu.748_B20211015

Patch Information

At the time of publication, no vendor-supplied patch is referenced in the NVD entry for CVE-2026-51745. Check the TOTOLINK official website and the TOTOLINK firmware download page for firmware updates addressing the updatePriStaList access control issue.

Workarounds

Segment the router management plane so that only trusted administrative hosts can reach the cs_broker port
Apply host-based or upstream firewall rules that drop MQTT traffic from unauthorized sources
Where feasible, disable remote management features and any exposed MQTT listeners until a firmware update is available

bash

# Example: block inbound MQTT (default port 1883) at an upstream firewall
iptables -A FORWARD -p tcp --dport 1883 -d <TOTOLINK_T6_IP> -j DROP
iptables -A FORWARD -p tcp --dport 8883 -d <TOTOLINK_T6_IP> -j DROP