CVE-2026-51763: TOTOLINK T6 Auth Bypass Vulnerability

CVE-2026-51763 Overview

CVE-2026-51763 is an incorrect access control vulnerability in the freeStaClient function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can forcibly disconnect wireless clients by sending a crafted Message Queuing Telemetry Transport (MQTT) message to the cs_broker component. The flaw is tracked under CWE-284: Improper Access Control and does not require credentials or user interaction to exploit.

Critical Impact
Remote, unauthenticated attackers on the network can disconnect any wireless client from the affected TOTOLINK T6 access point, disrupting connectivity for all associated devices.

Affected Products

TOTOLINK T6 router, firmware 4.1.5cu.748_B20211015
freeStaClient function within the router firmware
cs_broker MQTT component exposed by the device

Discovery Timeline

2026-09-01 - CVE-2026-51763 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-51763

Vulnerability Analysis

The TOTOLINK T6 exposes an MQTT broker referred to as cs_broker, which handles internal control messages for wireless client management. The freeStaClient function processes messages that trigger disassociation of connected stations. The function does not verify whether the sender is authenticated or authorized to issue disconnect commands.

An attacker who can reach the broker over the network can publish a crafted MQTT message that invokes freeStaClient, forcing arbitrary wireless clients to disconnect. This provides an unauthenticated denial-of-service primitive against every station associated with the affected access point. Repeated messages sustain the disruption indefinitely.

Root Cause

The root cause is missing authorization checks on MQTT topics handled by cs_broker. Control messages that affect station state are accepted from any client that can publish to the broker. The freeStaClient handler acts on message contents without validating the identity or privilege level of the publisher, violating the access control expectations for a station management routine.

Attack Vector

Exploitation requires network reachability to the MQTT broker exposed by the TOTOLINK T6. The attacker publishes a crafted MQTT payload targeting the topic serviced by freeStaClient, specifying the wireless client to disconnect. No authentication, session, or user interaction is required. The impact is loss of availability for wireless clients, with cascading effects on services that depend on continuous connectivity.

No verified exploit code is publicly indexed at the time of writing. See the GitHub coordination documentation for additional context published by the reporting researchers.

Detection Methods for CVE-2026-51763

Indicators of Compromise

Unsolicited MQTT PUBLISH packets destined for the router's cs_broker component from clients that are not part of normal management traffic.
Repeated wireless client Deauthentication or Disassociation events on the TOTOLINK T6 with no corresponding user or administrative action.
Sudden loss of Wi-Fi connectivity across multiple stations followed by immediate reassociation attempts.

Detection Strategies

Inspect network traffic on TCP port 1883 (or the configured MQTT port) reaching the router and alert on publishes from non-management sources.
Correlate router syslog entries referencing freeStaClient or station-free events with the source of the triggering MQTT message.
Baseline normal MQTT topic activity for the cs_broker component and flag anomalous topics, payload sizes, or publisher identities.

Monitoring Recommendations

Forward TOTOLINK T6 logs to a centralized logging platform and retain deauthentication events for correlation.
Monitor for repeated short-duration disconnections affecting the same station, which indicates sustained abuse of freeStaClient.
Track MQTT connection counts and publisher source addresses on the LAN to identify unauthorized broker access.

How to Mitigate CVE-2026-51763

Immediate Actions Required

Restrict network access to the TOTOLINK T6 management and MQTT interfaces so only trusted administrative hosts can reach them.
Segment the router's control plane from general user VLANs and guest networks to prevent unauthenticated broker access.
Disable remote management features and any WAN-side exposure of MQTT services on the affected device.

Patch Information

No vendor patch is referenced in the enriched CVE data. Check the TOTOLINK Firmware Download Page and the TOTOLINK Official Website for updated firmware for the T6 model. Apply any newer firmware than 4.1.5cu.748_B20211015 as soon as the vendor publishes a fix that addresses the freeStaClient access control gap.

Workarounds

Place the TOTOLINK T6 behind a firewall that blocks inbound MQTT traffic (default TCP 1883 and 8883) from untrusted segments.
Enable wireless client isolation so associated stations cannot reach the router's internal broker directly.
If the device is deployed in a sensitive environment, replace it with hardware that enforces authenticated MQTT access until a firmware fix is available.

bash

# Configuration example: block MQTT reachability to the router from client VLANs
iptables -A FORWARD -p tcp --dport 1883 -d <router-ip> -j DROP
iptables -A FORWARD -p tcp --dport 8883 -d <router-ip> -j DROP