CVE-2026-51754: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51754 Overview

CVE-2026-51754 is an incorrect access control vulnerability in the updateSlaveIpList function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. The flaw resides in the cs_broker component, which processes MQTT (Message Queuing Telemetry Transport) messages without proper authentication. Unauthenticated attackers can send crafted MQTT messages to overwrite the slave IP inventory state on the device. This gives adversaries control over the router's tracking of connected slave nodes in mesh deployments.

Critical Impact
Unauthenticated attackers on the network can manipulate the slave IP inventory of TOTOLINK T6 routers by sending crafted MQTT messages to the cs_broker component, undermining the integrity of mesh network state.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
cs_broker MQTT component and updateSlaveIpList function

Discovery Timeline

2026-09-01 - CVE-2026-51754 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51754

Vulnerability Analysis

The TOTOLINK T6 firmware exposes a cs_broker component that handles MQTT communications between master and slave devices in mesh configurations. The updateSlaveIpList function processes incoming messages that update the router's slave IP inventory. The function does not validate whether the sender is authenticated or authorized to modify this state. Any client that can reach the MQTT broker on the network can send messages that alter the recorded slave IP list.

Because the inventory tracks which downstream devices participate in the mesh, tampering with this state can disrupt routing, redirect traffic assumptions, or facilitate follow-on attacks against connected clients. The vulnerability is categorized as a broken access control issue on a network protocol handler.

Root Cause

The root cause is missing authentication and authorization checks in the updateSlaveIpList handler. The cs_broker component accepts MQTT messages and applies state changes without verifying the identity or privilege of the publisher. There is no access control enforcement between untrusted network peers and privileged internal state updates.

Attack Vector

An attacker within reach of the MQTT broker port on the TOTOLINK T6 router crafts an MQTT publish message directed at the topic consumed by updateSlaveIpList. The cs_broker component parses the message and applies the attacker-controlled IP list to the device's slave inventory. No credentials, session tokens, or handshake are required. The vulnerability's EPSS probability is 0.173% at the 6.85 percentile.

See the GitHub CVE Coordination ReadMe for the coordinator's technical write-up.

Detection Methods for CVE-2026-51754

Indicators of Compromise

Unexpected MQTT publish traffic directed at the cs_broker component on TOTOLINK T6 routers
Unexplained modifications to the router's slave IP inventory or mesh topology state
MQTT clients connecting from IP addresses outside the expected mesh participant set

Detection Strategies

Inspect network traffic for MQTT messages targeting cs_broker topics from unauthorized sources on the LAN or management network
Baseline the expected list of slave IPs and alert on out-of-band changes to that inventory
Correlate router configuration snapshots over time to identify unauthorized state overwrites

Monitoring Recommendations

Log all MQTT connections and publish events reaching the router when logging is available
Monitor for anomalous device counts or IP additions within the mesh management interface
Segment router management traffic so MQTT is only reachable from trusted mesh peers

How to Mitigate CVE-2026-51754

Immediate Actions Required

Restrict network access to the MQTT service on TOTOLINK T6 routers to trusted mesh participants only using firewall or VLAN segmentation
Remove untrusted or guest devices from any network segment that can reach the cs_broker component
Check the TOTOLINK Firmware Download Page for any updated firmware releases addressing this issue

Patch Information

No vendor patch is referenced in the current CVE data. Consult the TOTOLINK Official Website and the firmware download portal for updated releases. Track the CVE coordination repository for disclosure updates.

Workarounds

Block inbound MQTT traffic (typically TCP/1883 and TCP/8883) at network boundaries where the router is exposed
Isolate the TOTOLINK T6 router on a dedicated management VLAN accessible only to administrative hosts
Where feasible, replace vulnerable devices with hardware from vendors that enforce authentication on MQTT control channels

bash

# Example: block untrusted MQTT traffic to the router at an upstream firewall
iptables -A FORWARD -p tcp --dport 1883 -d <ROUTER_IP> -j DROP
iptables -A FORWARD -p tcp --dport 8883 -d <ROUTER_IP> -j DROP