CVE-2026-51762: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51762 Overview

CVE-2026-51762 is an incorrect access control vulnerability in the meshInfoKick function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015. Unauthenticated attackers can send a crafted MQTT message to the cs_broker component to kick or clean stale mesh information and trigger regeneration of mesh metadata. The flaw exists because the function fails to validate the identity or authorization of the message sender before performing state-changing operations on mesh network data.

Critical Impact
Remote unauthenticated attackers can manipulate mesh network state on affected TOTOLINK T6 devices by sending crafted MQTT messages, disrupting mesh connectivity and forcing metadata regeneration.

Affected Products

TOTOLINK T6 router
Firmware version 4.1.5cu.748_B20211015
cs_broker MQTT component and meshInfoKick function

Discovery Timeline

2026-09-01 - CVE-2026-51762 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51762

Vulnerability Analysis

The TOTOLINK T6 uses an MQTT (Message Queuing Telemetry Transport) broker component named cs_broker to coordinate mesh networking state between nodes. The meshInfoKick function subscribes to MQTT topics used to manage mesh membership. When a message arrives on the relevant topic, the function processes it and performs actions that affect mesh state, including removing stale peer entries and regenerating mesh metadata.

The function does not verify whether the publisher of the MQTT message is authorized to trigger these operations. Any client capable of reaching the MQTT broker on the device can publish a matching message and cause the router to act on it. Because MQTT is exposed to the local network segment, an unauthenticated attacker with network reachability to the broker can trigger the code path repeatedly.

Root Cause

The root cause is missing authentication and authorization on inbound MQTT messages consumed by meshInfoKick. The function trusts message content as authoritative without validating sender identity, message signatures, or broker-level access controls. This maps to the improper access control weakness class.

Attack Vector

An attacker within network range of the cs_broker MQTT interface publishes a crafted MQTT message to the topic handled by meshInfoKick. The device processes the message and executes the kick/clean logic on mesh peers, deleting cached mesh state and forcing regeneration. Repeated exploitation can destabilize mesh connectivity between paired nodes and interrupt client sessions dependent on the mesh backhaul. See the vendor coordination write-up for additional detail.

Detection Methods for CVE-2026-51762

Indicators of Compromise

Unexpected MQTT PUBLISH messages targeting mesh management topics on the cs_broker component
Repeated regeneration of mesh metadata entries in router logs without corresponding administrator action
Frequent mesh peer disconnections and re-associations on TOTOLINK T6 nodes
MQTT connections from clients outside the expected mesh node set

Detection Strategies

Monitor MQTT broker traffic on affected devices for unauthenticated publishers on mesh-related topics
Correlate mesh state changes with the source of MQTT messages that triggered them
Alert on anomalous frequency of meshInfoKick invocations in device logs where log access is available

Monitoring Recommendations

Capture and inspect MQTT traffic on the LAN segments hosting TOTOLINK T6 devices
Track wireless client disassociation and mesh peer reset events over time
Log and review connections to TCP port 1883 or other MQTT ports exposed by the router

How to Mitigate CVE-2026-51762

Immediate Actions Required

Restrict network access to the cs_broker MQTT interface using firewall rules or VLAN segmentation
Isolate TOTOLINK T6 devices from untrusted network segments and guest networks
Disable mesh networking features if they are not required in the deployment
Monitor the TOTOLINK firmware download page for updated firmware addressing this issue

Patch Information

No vendor patch has been published in the referenced advisories at the time of NVD publication. Administrators should check the TOTOLINK official website and the coordination trackers on DarkBoulder's repository and ShengWu00's repository for updates.

Workarounds

Place affected devices behind an upstream firewall that blocks inbound MQTT traffic from untrusted hosts
Limit Wi-Fi access to trusted clients only using WPA2/WPA3 with strong pre-shared keys to reduce local attacker reach
Replace the affected TOTOLINK T6 device with hardware that receives active security maintenance if no patch is released
Disable remote management interfaces to reduce the exposed attack surface