CVE-2026-51747: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51747 Overview

CVE-2026-51747 is an incorrect access control vulnerability in the keepAlive function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can send crafted MQTT messages to the cs_broker component. This allows them to emit indirect mesh heartbeat information toward the master node without authentication. The flaw impacts the mesh networking capability of the affected TOTOLINK T6 router, undermining trust between mesh participants and the master controller.

Critical Impact
Unauthenticated attackers can inject forged mesh heartbeat messages into the TOTOLINK T6 mesh network by delivering crafted MQTT payloads to the cs_broker service.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
cs_broker MQTT component and keepAlive function

Discovery Timeline

2026-09-01 - CVE-2026-51747 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51747

Vulnerability Analysis

The vulnerability resides in the keepAlive function exposed through the cs_broker component of the TOTOLINK T6 mesh implementation. The cs_broker component uses Message Queuing Telemetry Transport (MQTT) to coordinate mesh state between nodes and the master. The keepAlive function fails to verify whether the sender of a heartbeat message is an authenticated, trusted mesh participant. As a result, any network-adjacent actor able to reach the broker can publish crafted heartbeat messages that the master node processes as legitimate mesh traffic.

Root Cause

The root cause is missing authentication and authorization checks on inbound MQTT messages handled by the keepAlive function. The cs_broker component treats MQTT publishers as implicitly trusted mesh members and does not validate identity before propagating heartbeat state. This is a classic Improper Access Control weakness in an embedded device management protocol.

Attack Vector

An attacker who can reach the MQTT broker exposed by the TOTOLINK T6 constructs a crafted MQTT publish message targeting the topic consumed by the keepAlive function. The message includes forged mesh heartbeat data referencing a target node. Because no credential check occurs, the broker accepts the message and the master node receives an indirect heartbeat as if it originated from a legitimate mesh peer. No user interaction and no prior authentication are required. Refer to the GitHub CVE Coordination Overview for additional context on the reported behavior.

Detection Methods for CVE-2026-51747

Indicators of Compromise

Unexpected MQTT publish traffic directed at the cs_broker component on the TOTOLINK T6 from untrusted network segments.
Mesh heartbeat records at the master node referencing nodes that are offline or unknown.
Anomalous connections to the router's MQTT listener from clients that are not part of the authorized mesh.

Detection Strategies

Inspect network flows to and from the router for MQTT sessions originating outside the trusted mesh VLAN.
Correlate mesh state changes at the master with the source of the triggering MQTT message.
Alert on inbound MQTT PUBLISH frames referencing keepAlive topics from unmanaged devices.

Monitoring Recommendations

Capture packet metadata for MQTT traffic on the LAN segment hosting TOTOLINK T6 devices and forward it to a centralized analytics platform.
Maintain an inventory of legitimate mesh peers and alert when new MAC or IP addresses publish to broker topics.
Monitor router syslog output for repeated or malformed heartbeat processing events.

How to Mitigate CVE-2026-51747

Immediate Actions Required

Restrict access to the TOTOLINK T6 management and mesh network segments so that only trusted mesh nodes can reach the cs_broker MQTT service.
Disable mesh functionality if it is not required in the deployment.
Segment IoT and consumer router infrastructure away from sensitive networks and user endpoints.

Patch Information

No vendor patch is referenced in the current NVD entry for CVE-2026-51747. Administrators should monitor the TOTOLINK firmware download page and the TOTOLINK official website for updated firmware releases addressing the keepAlive access control flaw.

Workarounds

Place TOTOLINK T6 devices behind a firewall that blocks inbound MQTT (default TCP 1883 and TLS 8883) from untrusted sources.
Isolate mesh nodes on a dedicated VLAN with strict Layer 2 and Layer 3 access controls to prevent rogue MQTT publishers from reaching the broker.
Where feasible, retire vulnerable firmware version 4.1.5cu.748_B20211015 in favor of a device or firmware without the exposed cs_broker service.

bash

# Example: block external MQTT access to the TOTOLINK T6 broker at an upstream firewall
iptables -A FORWARD -p tcp --dport 1883 -d <TOTOLINK_T6_IP> -j DROP
iptables -A FORWARD -p tcp --dport 8883 -d <TOTOLINK_T6_IP> -j DROP