CVE-2026-51764 Overview
CVE-2026-51764 is an incorrect access control vulnerability in the recvSlaveCloudCheckStatus function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can overwrite cloud-result tracking files by sending a crafted Message Queuing Telemetry Transport (MQTT) message to the cs_broker component. The flaw is classified under [CWE-284: Improper Access Control] and affects the router's cloud-check subsystem.
Critical Impact
Remote, unauthenticated attackers can manipulate cloud tracking state on affected TOTOLINK T6 routers over the network without user interaction, enabling integrity and availability compromise of the device.
Affected Products
- TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015
- The vulnerable recvSlaveCloudCheckStatus handler in the cs_broker component
- Devices exposing the MQTT broker interface to reachable networks
Discovery Timeline
- 2026-09-01 - CVE-2026-51764 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-51764
Vulnerability Analysis
The vulnerability resides in the recvSlaveCloudCheckStatus function, which processes MQTT messages received by the cs_broker component on the TOTOLINK T6 router. The handler does not enforce authentication or authorization checks before acting on inbound messages. Attackers can send crafted MQTT payloads directly to the broker and cause the router to overwrite cloud-result tracking files used by the device.
Because the affected code path runs with the privileges of the cloud-check service, arbitrary file overwrite in this context can disrupt cloud connectivity state, poison status information reported upstream, and undermine the integrity of dependent management workflows.
Root Cause
The root cause is a missing access control check [CWE-284] in the MQTT message handler. The recvSlaveCloudCheckStatus routine trusts any peer that can deliver a message to cs_broker and treats the message content as authoritative. No cryptographic authentication, topic-level authorization, or source validation gates the write operation to the cloud-result tracking files.
Attack Vector
Exploitation requires network access to the MQTT broker exposed by the TOTOLINK T6 device. An attacker constructs an MQTT publish message targeting the topic consumed by recvSlaveCloudCheckStatus and delivers it to cs_broker. The service then processes the message and overwrites the cloud-result tracking files with attacker-controlled content. No credentials, prior session, or user interaction are required.
No verified proof-of-concept code is currently published. Technical details are tracked in the vendor coordination repositories referenced by the advisory: DarkBoulder CVE Coordination and ShengWu00 CVE Coordination.
Detection Methods for CVE-2026-51764
Indicators of Compromise
- Unexpected modifications to cloud-result tracking files on TOTOLINK T6 devices running firmware 4.1.5cu.748_B20211015.
- Inbound MQTT PUBLISH packets to cs_broker from untrusted source addresses.
- Anomalous cloud status entries reported by the router that do not correspond to legitimate cloud-check activity.
Detection Strategies
- Inspect network traffic for MQTT sessions (default TCP port 1883, or 8883 for MQTT over TLS) originating from unexpected internal or external hosts toward affected devices.
- Deploy signatures that flag MQTT PUBLISH messages referencing cloud-check topics processed by recvSlaveCloudCheckStatus.
- Correlate router log entries about cloud status changes with authorized cloud-management events; investigate unmatched changes.
Monitoring Recommendations
- Enable flow logging on network segments hosting TOTOLINK T6 devices and alert on any external MQTT connections.
- Track file integrity of cloud-result tracking files where the firmware exposes them to management tooling.
- Monitor for repeated MQTT connection attempts to cs_broker from a single source, which may indicate scanning or exploitation attempts.
How to Mitigate CVE-2026-51764
Immediate Actions Required
- Restrict network access to the MQTT broker on TOTOLINK T6 devices so that only trusted management systems can reach the cs_broker service.
- Block inbound TCP ports 1883 and 8883 at the network perimeter for affected devices.
- Inventory TOTOLINK T6 units running firmware 4.1.5cu.748_B20211015 and prioritize them for remediation.
Patch Information
No vendor patch has been referenced in the current NVD entry. Check the TOTOLINK official website and the TOTOLINK download portal for firmware updates addressing CVE-2026-51764. Apply firmware updates as soon as the vendor publishes a fixed release.
Workarounds
- Place affected routers behind a network segmentation boundary that denies MQTT traffic from untrusted networks.
- Disable cloud-management features on the device where feasible until a firmware update is available.
- Replace end-of-support units with devices that receive active security maintenance.
# Configuration example: block MQTT traffic to affected devices at an upstream firewall
iptables -A FORWARD -p tcp --dport 1883 -d <TOTOLINK_T6_IP> -j DROP
iptables -A FORWARD -p tcp --dport 8883 -d <TOTOLINK_T6_IP> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
