CVE-2026-51761: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51761 Overview

CVE-2026-51761 is an incorrect access control vulnerability [CWE-284] in the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. The flaw exists in the updateLanIp function, which processes MQTT messages received by the cs_broker component. Unauthenticated attackers on the network can send a crafted MQTT message to refresh the LAN address state on the device. The vulnerability affects the integrity of network configuration without requiring authentication or user interaction.

Critical Impact
Unauthenticated network-adjacent attackers can manipulate LAN address state on affected TOTOLINK T6 devices by sending crafted MQTT messages to the cs_broker component, disrupting local network operations.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
cs_broker MQTT component within the firmware

Discovery Timeline

2026-09-01 - CVE-2026-51761 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51761

Vulnerability Analysis

The TOTOLINK T6 firmware exposes an MQTT broker (cs_broker) that accepts messages from network peers. The updateLanIp handler processes messages related to LAN address configuration state. The handler does not enforce authentication or authorization checks before acting on inbound MQTT payloads. Attackers can therefore submit crafted messages that trigger a refresh of the LAN address state.

The issue maps to Improper Access Control [CWE-284]. The vulnerability affects integrity because attacker-supplied messages influence device state that should be reserved for authenticated administrative flows. Confidentiality and availability are not directly impacted based on the current advisory.

Root Cause

The root cause is missing access control on the MQTT topic or handler routing to updateLanIp. The cs_broker component treats inbound MQTT messages as trusted and dispatches them to state-changing handlers. No authentication tokens, message signing, or origin validation gate the code path. Any client able to reach the broker over the network can invoke the handler.

Attack Vector

Exploitation requires network reachability to the MQTT broker port on the affected TOTOLINK T6 device. An attacker connects to the cs_broker service and publishes a crafted MQTT message targeting the topic consumed by updateLanIp. The device processes the message and refreshes the LAN address state. Because the attack is unauthenticated and requires no user interaction, it can be scripted against any exposed device.

No public exploit code is currently listed in the advisory. Technical details are tracked through the DarkBoulder CVE Coordination Guide and the ShengWu00 CVE Coordination Guide.

Detection Methods for CVE-2026-51761

Indicators of Compromise

Unexpected MQTT PUBLISH traffic to the cs_broker component on TOTOLINK T6 devices from unauthorized sources.
Unscheduled changes to LAN address configuration or state refreshes recorded in router logs.
MQTT connections from external or non-management network segments to the router.

Detection Strategies

Inspect network flows for MQTT protocol traffic (default TCP 1883 and TLS 8883) directed at TOTOLINK T6 devices and validate the source against approved management hosts.
Deploy signatures on network sensors to flag MQTT PUBLISH packets referencing LAN configuration topics targeting router IP addresses.
Correlate router configuration change events with authenticated administrative sessions; alert on state changes lacking a corresponding login.

Monitoring Recommendations

Enable syslog forwarding from TOTOLINK T6 devices to a central logging platform and monitor for LAN address refresh events.
Baseline MQTT traffic patterns for each device and alert on new publishers or unusual topic access.
Track DHCP and ARP anomalies on segments served by the affected router, which can indicate LAN state manipulation.

How to Mitigate CVE-2026-51761

Immediate Actions Required

Restrict network access to the MQTT broker port on TOTOLINK T6 devices using upstream firewall rules or VLAN segmentation.
Inventory TOTOLINK T6 devices running firmware 4.1.5cu.748_B20211015 and prioritize them for remediation.
Block inbound MQTT traffic from the internet and from untrusted internal segments to router management interfaces.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD advisory. Check the TOTOLINK official website and the TOTOLINK firmware download page for firmware updates addressing CVE-2026-51761. Apply updated firmware to all affected T6 devices once released.

Workarounds

Place affected devices behind a network firewall that denies inbound MQTT traffic from untrusted networks.
Disable remote management features and any cloud or MQTT-based integration that is not required for operations.
Segment IoT and consumer router management traffic onto a dedicated VLAN with strict access control lists.
Replace end-of-support devices with hardware receiving active security maintenance if no patch is released.

bash

# Example firewall rule to block external MQTT traffic to a TOTOLINK T6 device
iptables -A FORWARD -p tcp --dport 1883 -d <router_ip> -j DROP
iptables -A FORWARD -p tcp --dport 8883 -d <router_ip> -j DROP