CVE-2026-51756: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51756 Overview

CVE-2026-51756 is an incorrect access control vulnerability [CWE-284] in the meshSlaveUpgfw function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. The flaw permits unauthenticated attackers to trigger firmware flashing operations by delivering a crafted MQTT message to the cs_broker component. Because the function does not validate the identity or authorization of the requester, any network-reachable attacker who can communicate with the broker can initiate the upgrade routine using existing firmware images already present on the device.

Critical Impact
An unauthenticated attacker on the network can force the TOTOLINK T6 to begin flashing firmware, disrupting device integrity and mesh availability.

Affected Products

TOTOLINK T6 mesh router
Firmware version 4.1.5cu.748_B20211015
cs_broker MQTT service component

Discovery Timeline

2026-09-01 - CVE-2026-51756 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51756

Vulnerability Analysis

The TOTOLINK T6 exposes an MQTT broker named cs_broker used for mesh coordination between the primary node and slave nodes. The meshSlaveUpgfw handler subscribes to upgrade-related topics and invokes firmware flashing logic when a matching message is received. The handler does not authenticate the publisher or verify that the message originates from a trusted mesh peer. An attacker who can reach the broker over the network can publish a crafted message that satisfies the handler's parsing logic and triggers a firmware flash using upgrade files already staged on the device.

Exploitation does not require credentials, user interaction, or supplying a malicious firmware image. The impact is confined to confidentiality of internal firmware state and disruption of the upgrade path rather than direct code execution, which aligns with the CVSS confidentiality-only impact profile.

Root Cause

The root cause is a missing authorization check inside meshSlaveUpgfw. MQTT messages arriving at cs_broker are trusted implicitly based on topic membership rather than validated against a mesh peer identity or shared secret. This design assumption breaks whenever the broker is exposed on an interface reachable by an attacker.

Attack Vector

The attack is network-based. An attacker connects to the cs_broker MQTT service on the affected TOTOLINK T6 device and publishes a specially formed message on the topic consumed by meshSlaveUpgfw. The device then initiates firmware flashing against the previously staged upgrade file. Exploitation complexity is elevated because the attacker must reach the broker interface and match the expected message structure. See the GitHub Coordination Document by DarkBoulder and the GitHub Coordination Document by ShengWu00 for technical coordination details.

Detection Methods for CVE-2026-51756

Indicators of Compromise

Unexpected firmware flashing events or reboots on TOTOLINK T6 devices without an administrator-initiated upgrade.
Inbound MQTT connections to the cs_broker port from hosts that are not authorized mesh peers.
MQTT PUBLISH messages targeting the meshSlaveUpgfw topic from unfamiliar client identifiers.

Detection Strategies

Monitor network flows for MQTT traffic (typically TCP/1883 or TCP/8883) reaching TOTOLINK T6 devices from non-mesh sources.
Inspect device logs for repeated meshSlaveUpgfw invocations or firmware upgrade routines that do not correlate with change management records.
Correlate unexpected device reboots on the mesh with concurrent MQTT publish activity captured at the network edge.

Monitoring Recommendations

Alert on any MQTT broker exposure of TOTOLINK T6 devices on LAN segments accessible to guest, IoT, or untrusted networks.
Baseline normal mesh MQTT peers and flag deviations, including new client IDs or unusual publish frequencies.
Track firmware version transitions across managed TOTOLINK devices to identify unauthorized flash operations.

How to Mitigate CVE-2026-51756

Immediate Actions Required

Restrict network access to the cs_broker MQTT service so it is reachable only by legitimate mesh nodes.
Segment TOTOLINK T6 devices onto a management VLAN isolated from user, guest, and IoT networks.
Audit deployed TOTOLINK T6 units for firmware version 4.1.5cu.748_B20211015 and prioritize them for remediation.

Patch Information

At the time of publication, no vendor advisory or fixed firmware release has been referenced in the NVD entry. Check the TOTOLINK Official Website and the TOTOLINK Download Page for updated firmware and vendor guidance.

Workarounds

Block inbound MQTT traffic to affected TOTOLINK T6 devices at the network boundary until a vendor patch is available.
Disable mesh functionality on devices where it is not required, which removes the exposed cs_broker code path.
Deploy host-based ACLs or upstream firewall rules that permit MQTT only from known mesh peer IP addresses.

bash

# Example iptables rule restricting cs_broker MQTT access to trusted mesh peers
iptables -A INPUT -p tcp --dport 1883 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -j DROP