CVE-2026-51751: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51751 Overview

CVE-2026-51751 is an incorrect access control vulnerability in the delSlaveDevice function of the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to send crafted Message Queuing Telemetry Transport (MQTT) messages to the cs_broker component. Successful exploitation removes a specified slave device from local mesh management data and reboots the target system. The weakness is tracked under [CWE-284: Improper Access Control].

Critical Impact

Unauthenticated network attackers can disrupt mesh network operations and force system reboots on affected TOTOLINK T6 devices, causing service outages across the mesh deployment.

Affected Products

• TOTOLINK T6 router firmware 4.1.5cu.748_B20211015
• TOTOLINK T6 mesh management component (cs_broker)
• TOTOLINK T6 delSlaveDevice function

Discovery Timeline

• 2026-09-01 - CVE-2026-51751 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-51751

Vulnerability Analysis

The TOTOLINK T6 router exposes a mesh management service through the cs_broker component, which processes MQTT messages to coordinate slave devices in a mesh topology. The delSlaveDevice function accepts device removal requests without enforcing authentication or authorization checks. Any network-reachable attacker who can deliver an MQTT message to the broker can trigger the removal logic. The function proceeds to delete the target slave device from local mesh management state and initiates a system reboot as part of the cleanup workflow.

Root Cause

The root cause is the absence of access control validation on inbound MQTT messages targeting the delSlaveDevice handler. The broker trusts the message payload and processes device deletion requests without verifying the sender's identity or permissions. This mirrors the classification under [CWE-284: Improper Access Control], where a security-sensitive operation lacks the authorization gate that would normally restrict it to authenticated administrators.

Attack Vector

The attack is delivered over the network with low complexity and no authentication or user interaction. An attacker crafts an MQTT publish message that invokes the delSlaveDevice operation and directs it at the cs_broker component of the target T6 device. On receipt, the router removes the referenced slave device from its mesh state and reboots. Repeated messages can be used to sustain a denial-of-service condition against the mesh network.

No verified proof-of-concept code has been published. See the GitHub CVE Coordination Repository for coordination details.

Detection Methods for CVE-2026-51751

Indicators of Compromise

• Unexpected reboots of TOTOLINK T6 mesh routers with no administrative action logged.
• Slave devices disappearing from mesh management data and reconnecting shortly afterward.
• Inbound MQTT connections to the cs_broker component from untrusted network segments.

Detection Strategies

• Monitor MQTT traffic on the local network for publish messages referencing delSlaveDevice or the cs_broker topic namespace.
• Correlate router uptime resets with preceding MQTT message activity to identify triggered reboot events.
• Alert on repeated mesh membership changes within short time windows, which suggest scripted abuse of the deletion handler.

Monitoring Recommendations

• Log all MQTT broker interactions and forward them to a centralized logging platform for retention and analysis.
• Track TOTOLINK T6 device availability and reboot counters through network management tooling.
• Baseline normal mesh device membership so that unauthorized removals stand out against expected topology changes.

How to Mitigate CVE-2026-51751

Immediate Actions Required

• Restrict network access to the TOTOLINK T6 management and MQTT interfaces to trusted administrative segments only.
• Block inbound connections to the cs_broker MQTT port from untrusted Wi-Fi clients and external networks.
• Audit mesh membership regularly to detect unauthorized slave device removals.

Patch Information

No vendor patch has been referenced in the published advisory at the time of writing. Consult the TOTOLINK Product Download Page and the TOTOLINK Official Website for firmware updates addressing CVE-2026-51751. Additional coordination details are available in the GitHub CVE Coordination Repository.

Workarounds

• Segment TOTOLINK T6 devices onto a management VLAN that blocks MQTT traffic from client networks.
• Disable remote management features and any exposed MQTT listeners when they are not required for mesh operation.
• Apply firewall rules on upstream gateways to drop unsolicited MQTT traffic destined for the router.

# Example firewall rule to block untrusted MQTT traffic to the router
iptables -A INPUT -p tcp --dport 1883 -s <trusted_admin_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -j DROP