CVE-2026-51748: TOTOLINK T6 Authentication Bypass Flaw

CVE-2026-51748 Overview

CVE-2026-51748 is an incorrect access control vulnerability in the sendStaticInfoToMaster function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw resides in the cs_broker component, which processes MQTT (Message Queuing Telemetry Transport) messages without authenticating the sender. Unauthenticated attackers on the network can send a crafted MQTT message to update stored slave inventory records on the device. The weakness maps to [CWE-284: Improper Access Control].

Critical Impact
Remote unauthenticated attackers can tamper with slave inventory records maintained by the TOTOLINK T6 master node, corrupting mesh network state and integrity.

Affected Products

TOTOLINK T6 mesh router firmware version 4.1.5cu.748_B20211015
The cs_broker MQTT broker component on the T6 device
The sendStaticInfoToMaster function used for master-slave inventory synchronization

Discovery Timeline

2026-09-01 - CVE-2026-51748 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51748

Vulnerability Analysis

The TOTOLINK T6 mesh router uses an MQTT broker (cs_broker) to coordinate state between the master node and slave devices. The sendStaticInfoToMaster function accepts MQTT messages that update stored inventory records describing slave devices attached to the mesh. The function does not verify that the MQTT publisher is an authorized slave. Any network-reachable attacker who can publish to the topic consumed by cs_broker can inject arbitrary records into the master's inventory store. This breaks the integrity of the mesh topology data used by the router for management and orchestration decisions.

Root Cause

The root cause is missing authorization enforcement in the MQTT message handler. The sendStaticInfoToMaster handler trusts the message payload and does not validate the identity or authorization of the publishing client before writing to persistent inventory storage. MQTT by default does not enforce client authentication, and the T6 firmware does not layer application-level access control on top of the broker.

Attack Vector

An attacker with network access to the cs_broker MQTT listener crafts an MQTT PUBLISH message targeting the topic consumed by sendStaticInfoToMaster. The payload contains attacker-chosen slave inventory fields. No credentials, tokens, or user interaction are required. Successful delivery causes the master to persist the forged record. The high attack complexity reflects the need to reach the broker port and craft a payload matching the expected schema. Confidentiality of inventory data held by the master is affected because injected records replace legitimate state.

No verified public exploit code is available. See the CVE Vendor Coordination write-up (DarkBoulder) and the CVE Vendor Coordination write-up (ShengWu00) for coordination details.

Detection Methods for CVE-2026-51748

Indicators of Compromise

Unexpected MQTT PUBLISH messages arriving at the T6 cs_broker listener from clients that are not registered mesh slaves.
Slave inventory records on the master containing MAC addresses, device identifiers, or hardware descriptors that do not match any physically deployed slave.
Log entries from cs_broker showing calls to sendStaticInfoToMaster outside of expected slave onboarding windows.

Detection Strategies

Monitor MQTT broker traffic on the T6 for connections originating from IP addresses outside the intended management VLAN.
Compare current slave inventory records against a known-good baseline captured immediately after deployment.
Alert on repeated PUBLISH operations to the topic consumed by sendStaticInfoToMaster from a single source.

Monitoring Recommendations

Capture packet traces on TCP 1883 (or the port used by cs_broker) and inspect PUBLISH payload structures.
Forward router syslog output to a central log store and retain records of inventory mutations for audit.
Track configuration drift on the T6 by periodically exporting the inventory database and diffing against a signed baseline.

How to Mitigate CVE-2026-51748

Immediate Actions Required

Restrict network access to the cs_broker MQTT port so it is reachable only from the mesh management VLAN.
Segment TOTOLINK T6 devices from untrusted LAN, guest Wi-Fi, and WAN-facing interfaces using firewall rules.
Audit the current slave inventory on affected T6 masters and remove any records that do not correspond to authorized hardware.

Patch Information

No vendor patch is listed in the NVD advisory at publication time. Check the TOTOLINK download page for firmware updates newer than 4.1.5cu.748_B20211015 and apply any released fix that addresses the sendStaticInfoToMaster access control gap.

Workarounds

Place the T6 mesh control plane behind a dedicated management network that blocks MQTT traffic from user segments.
Disable remote management interfaces and block inbound access to the MQTT broker port from the WAN.
Replace affected devices with hardware that enforces MQTT client authentication if segmentation is not feasible.

bash

# Configuration example: block external access to the cs_broker MQTT port
# Adjust interface names and the management CIDR to match the environment
iptables -A INPUT -i wan0 -p tcp --dport 1883 -j DROP
iptables -A INPUT -p tcp --dport 1883 ! -s 10.0.10.0/24 -j DROP