CVE-2026-51757: TOTOLINK T6 Authentication Bypass Vulnerability

CVE-2026-51757 Overview

CVE-2026-51757 is an incorrect access control vulnerability in the meshSlaveUpdate function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can send a crafted MQTT message to the cs_broker component to initiate a firmware download or flash workflow on a slave device in the mesh network. The flaw is classified under CWE-284: Improper Access Control and affects a network-accessible IoT device.

Critical Impact
An unauthenticated network attacker can trigger a firmware flash workflow on TOTOLINK T6 mesh slave devices, enabling persistent device compromise or bricking.

Affected Products

TOTOLINK T6 mesh router
Firmware version 4.1.5cu.748_B20211015
cs_broker MQTT component and meshSlaveUpdate function

Discovery Timeline

2026-09-01 - CVE-2026-51757 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-51757

Vulnerability Analysis

The TOTOLINK T6 mesh architecture uses an MQTT broker component named cs_broker for master-slave communication between mesh nodes. The meshSlaveUpdate function processes messages received through this broker to coordinate firmware update operations across the mesh.

The function fails to verify the sender's identity or authorization before acting on update instructions. Any client able to publish messages to the broker can therefore invoke the firmware download and flash workflow on a slave device. Because the broker is reachable over the network without authentication in the affected firmware, an unauthenticated attacker on an adjacent or reachable network can trigger the workflow directly.

Successful exploitation yields high impact to confidentiality, integrity, and availability: an attacker can supply an attacker-controlled firmware URL, replace legitimate firmware on the slave device, or interrupt device operation during the flash cycle. The EPSS score for this CVE is 0.442% with a percentile of 36.979.

Root Cause

The root cause is a missing authorization check in the meshSlaveUpdate handler. The function trusts MQTT message content without validating whether the publisher is an authenticated mesh master. This maps directly to CWE-284: Improper Access Control.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker with reach to the cs_broker MQTT endpoint publishes a crafted message on the topic consumed by meshSlaveUpdate. The slave device then acts on the message and begins downloading or flashing the specified firmware image.

No verified public exploit code is available at the time of publication. See the GitHub CVE coordination advisory for technical details on the MQTT topic and message structure.

Detection Methods for CVE-2026-51757

Indicators of Compromise

Unexpected MQTT publish traffic to the cs_broker component on TOTOLINK T6 devices from unknown clients.
Unscheduled firmware download requests originating from a mesh slave device to non-vendor URLs.
Slave devices rebooting or entering flash mode without an administrator-initiated update.
Firmware version drift between mesh master and slave that does not match a vendor-issued release.

Detection Strategies

Inspect network traffic for MQTT messages targeting cs_broker from clients outside the mesh master.
Monitor DNS and HTTP egress from mesh devices for firmware download URLs that do not resolve to TOTOLINK infrastructure.
Alert on repeated meshSlaveUpdate message patterns arriving from a single source IP.

Monitoring Recommendations

Log and retain MQTT broker traffic on segments where TOTOLINK T6 devices operate.
Track firmware version and build strings across mesh nodes and alert on unauthorized changes.
Baseline expected update windows and flag any flash workflow initiated outside those windows.

How to Mitigate CVE-2026-51757

Immediate Actions Required

Isolate TOTOLINK T6 devices on a management VLAN that blocks inbound MQTT traffic from untrusted networks.
Block external access to the cs_broker MQTT port on the device from the WAN and guest segments.
Inventory firmware versions and flag any device running 4.1.5cu.748_B20211015 for remediation.
Monitor the TOTOLINK download portal for a patched firmware release.

Patch Information

No fixed firmware version is listed in the NVD entry at time of publication. Consult the TOTOLINK official website and the vendor coordination advisory for updates on patched firmware availability.

Workarounds

Restrict the network segments that can reach the cs_broker MQTT endpoint to only trusted mesh master devices.
Disable mesh functionality where it is not required for the deployment.
Place the affected router behind a firewall that filters unsolicited MQTT (typically TCP 1883 and 8883) from untrusted sources.
Replace end-of-life or unpatchable devices with hardware that receives current security updates.

bash

# Example: block inbound MQTT to affected devices from untrusted segments
iptables -A FORWARD -p tcp --dport 1883 -s 0.0.0.0/0 -d <TOTOLINK_T6_IP> -j DROP
iptables -A FORWARD -p tcp --dport 8883 -s 0.0.0.0/0 -d <TOTOLINK_T6_IP> -j DROP