CVE-2026-51765 Overview
CVE-2026-51765 is an incorrect access control vulnerability [CWE-284] in the recvIndirectMeshInfo function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. Unauthenticated remote attackers can insert or replace mesh neighbor records by sending a crafted Message Queuing Telemetry Transport (MQTT) message to the cs_broker component. The flaw exposes the router's mesh routing state to arbitrary manipulation without any authentication or user interaction.
Critical Impact
Remote unauthenticated attackers can tamper with mesh neighbor records, enabling traffic redirection, man-in-the-middle positioning, and disruption of the mesh network fabric.
Affected Products
- TOTOLINK T6 router
- Firmware version 4.1.5cu.748_B20211015
- The cs_broker MQTT component handling recvIndirectMeshInfo
Discovery Timeline
- 2026-09-01 - CVE-2026-51765 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Last updated in the NVD database
Technical Details for CVE-2026-51765
Vulnerability Analysis
The TOTOLINK T6 exposes an MQTT broker (cs_broker) that processes mesh coordination messages between devices in a mesh network. The recvIndirectMeshInfo function accepts messages that update mesh neighbor records but does not validate the sender's identity or authorization. Any network-reachable client that can publish to the broker can insert or overwrite entries in the mesh neighbor table.
Because mesh neighbor state governs how frames are forwarded between nodes, tampering with this table lets an attacker influence path selection inside the mesh. The absence of authentication on a routing-plane function means integrity and availability of the network fabric can be undermined without credentials.
Root Cause
The root cause is missing access control [CWE-284] on the MQTT message handler. The recvIndirectMeshInfo function trusts incoming broker messages implicitly and applies neighbor record updates without verifying that the publisher is an authorized mesh peer. There is no authentication, session validation, or cryptographic binding between mesh nodes.
Attack Vector
An attacker who can reach the cs_broker MQTT endpoint over the network sends a crafted MQTT publish message targeting the mesh coordination topic consumed by recvIndirectMeshInfo. The payload contains attacker-chosen mesh neighbor entries. The device accepts and applies the records, altering the local mesh topology view.
Exploitation requires no privileges and no user interaction. Detailed proof-of-concept information is documented in the referenced TOTOLINK Vendor Coordination repository (DarkBoulder) and TOTOLINK Vendor Coordination repository (ShengWu00).
// No verified exploit code is published for this CVE.
// Refer to the vendor coordination repositories linked above for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-51765
Indicators of Compromise
- Unexpected MQTT publish traffic to the TOTOLINK T6 cs_broker endpoint from hosts that are not legitimate mesh peers.
- Unexplained changes to mesh neighbor tables, including new neighbor entries with unknown MAC or device identifiers.
- Traffic anomalies such as clients being routed through unexpected mesh hops or intermittent connectivity across mesh nodes.
Detection Strategies
- Monitor MQTT traffic on the local network for messages destined to the cs_broker component and alert on unauthorized publishers.
- Baseline the mesh neighbor topology and generate alerts when neighbor records are added, replaced, or churn unexpectedly.
- Inspect router logs for repeated calls into recvIndirectMeshInfo originating from unfamiliar sources.
Monitoring Recommendations
- Capture network flow telemetry from the LAN and mesh segments to detect lateral MQTT activity that should not exist on end-user networks.
- Log all mesh control-plane changes to a centralized logging platform for correlation and retention.
- Track firmware versions across deployed TOTOLINK T6 devices to identify hosts still exposed to CVE-2026-51765.
How to Mitigate CVE-2026-51765
Immediate Actions Required
- Restrict network access to the TOTOLINK T6 MQTT broker so only trusted mesh peers can reach the cs_broker port.
- Isolate affected TOTOLINK T6 devices from untrusted network segments and guest networks until a patched firmware is available.
- Inventory deployed TOTOLINK T6 devices running firmware 4.1.5cu.748_B20211015 and prioritize them for remediation.
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Check the TOTOLINK Firmware Download Page and the TOTOLINK Official Website for updated firmware releases addressing CVE-2026-51765.
Workarounds
- Place TOTOLINK T6 devices behind a firewall that blocks external access to MQTT ports and any mesh control interfaces.
- Disable mesh functionality on the device if it is not required for the deployment.
- Segment the router's management and mesh control traffic onto a dedicated VLAN with strict ingress filtering.
# Example: block external access to the default MQTT port at an upstream firewall
iptables -A FORWARD -p tcp --dport 1883 -d <TOTOLINK_T6_IP> -j DROP
iptables -A FORWARD -p tcp --dport 8883 -d <TOTOLINK_T6_IP> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
