CVE-2026-51752: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51752 Overview

CVE-2026-51752 is an incorrect access control vulnerability [CWE-284] in the staticInfoSend function of the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. The flaw resides in the cs_broker component, which handles Message Queuing Telemetry Transport (MQTT) messages. Unauthenticated remote attackers can send a crafted MQTT message to trigger static information reporting to the configured master. The vulnerability affects confidentiality only, with no impact on integrity or availability.

Critical Impact
Unauthenticated network attackers can coerce the device into disclosing static configuration information to an attacker-controlled or configured MQTT master.

Affected Products

TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015
cs_broker MQTT component within the affected firmware
staticInfoSend function exposed via the MQTT interface

Discovery Timeline

2026-09-01 - CVE-2026-51752 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51752

Vulnerability Analysis

The TOTOLINK T6 device exposes an MQTT broker component named cs_broker. The staticInfoSend function processes messages received through this broker and reports static device information to a configured master endpoint. The function does not validate the sender's identity or authorization before executing the reporting logic. An attacker who can reach the MQTT broker over the network can publish a crafted message that invokes this reporting path.

The issue is categorized as Improper Access Control [CWE-284]. It reflects a missing authorization check on a sensitive operational command exposed through a network-facing protocol. The impact is limited to information disclosure of static device data returned to the master destination.

Root Cause

The root cause is the absence of an authentication or authorization gate on the staticInfoSend handler inside cs_broker. The firmware trusts any client capable of publishing to the relevant MQTT topic. No client identity verification, access control list, or message authentication is enforced before the handler acts on the request.

Attack Vector

Exploitation requires network access to the MQTT broker exposed by the TOTOLINK T6. No credentials, user interaction, or elevated privileges are required. An attacker publishes a crafted MQTT message on the topic monitored by the cs_broker component, which then invokes staticInfoSend and transmits static device information to the master configured on the device.

No verified public proof-of-concept code is available for this vulnerability. See the GitHub coordination resource and the vendor coordination guide for coordination details.

Detection Methods for CVE-2026-51752

Indicators of Compromise

Unsolicited MQTT PUBLISH messages targeting the cs_broker component from unexpected source addresses
Outbound traffic from the TOTOLINK T6 to unrecognized MQTT master endpoints containing device static information
Repeated invocations of the staticInfoSend reporting path outside normal management windows

Detection Strategies

Inspect MQTT traffic to and from TOTOLINK T6 devices for unauthenticated PUBLISH operations on control topics
Baseline the normal cadence of static information reporting and alert on deviations that suggest attacker-triggered reports
Correlate router firmware version 4.1.5cu.748_B20211015 inventory with MQTT exposure on the network perimeter

Monitoring Recommendations

Log all MQTT sessions terminating on TOTOLINK T6 devices with source IP, client identifier, and topic accessed
Forward network telemetry to a centralized analytics platform for anomaly detection on IoT protocol traffic
Monitor firewall and NAT logs for inbound connections to MQTT ports (typically 1883/tcp and 8883/tcp) targeting affected devices

How to Mitigate CVE-2026-51752

Immediate Actions Required

Restrict network access to the MQTT broker exposed by TOTOLINK T6 devices using firewall rules or network segmentation
Block inbound connections to MQTT ports from untrusted networks, including the internet
Inventory all TOTOLINK T6 units running firmware 4.1.5cu.748_B20211015 and prioritize them for remediation

Patch Information

No vendor security advisory or patched firmware release for CVE-2026-51752 was referenced in the NVD entry at publication. Check the TOTOLINK official website and the TOTOLINK download page for firmware updates addressing this issue.

Workarounds

Place affected devices behind a network firewall that blocks external access to MQTT ports
Disable remote management features that expose the cs_broker component to untrusted networks
Segment IoT and consumer routers onto isolated VLANs with strict egress filtering to prevent information disclosure to attacker-controlled masters

bash

# Configuration example: block inbound MQTT to affected devices
iptables -A FORWARD -p tcp --dport 1883 -d <TOTOLINK_T6_IP> -j DROP
iptables -A FORWARD -p tcp --dport 8883 -d <TOTOLINK_T6_IP> -j DROP