CVE-2026-51767 Overview
CVE-2026-51767 is an incorrect access control vulnerability in the recvClearPairCfg function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. The flaw resides in the cs_broker component, which processes MQTT (Message Queuing Telemetry Transport) messages without properly authenticating the requester. Unauthenticated attackers can send a crafted MQTT message to reset the device pairing state and force a reboot. The result is a denial-of-service condition against affected TOTOLINK T6 devices on reachable networks.
Critical Impact
Unauthenticated attackers can reset pairing configuration and reboot TOTOLINK T6 routers by sending a single crafted MQTT message to the cs_broker component.
Affected Products
- TOTOLINK T6 router
- Firmware version 4.1.5cu.748_B20211015
- cs_broker MQTT component (recvClearPairCfg handler)
Discovery Timeline
- 2026-09-01 - CVE-2026-51767 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-51767
Vulnerability Analysis
The TOTOLINK T6 exposes an MQTT broker component named cs_broker for internal device coordination and pairing workflows. The recvClearPairCfg handler is registered to a topic that clears the current pairing configuration and triggers a device reboot. The handler executes the requested action without validating whether the publisher is an authorized management entity. Any client capable of publishing to the broker can invoke the reset path.
Because the affected function combines a state-clearing operation with a device reboot, successful exploitation produces immediate service disruption. Repeated messages create a persistent denial-of-service condition and can strip previously established pairing data on the device. The issue is classified as an Improper Access Control weakness ([CWE-284]).
Root Cause
The recvClearPairCfg function does not enforce authentication or authorization on inbound MQTT messages. The cs_broker component treats any successfully delivered message on the target topic as a legitimate administrative command. No session token, signature, or source validation gates the pairing-reset or reboot code paths.
Attack Vector
An attacker with network reachability to the cs_broker MQTT listener publishes a crafted message to the topic handled by recvClearPairCfg. The device processes the message, clears pairing state, and reboots. No credentials, prior session, or user interaction are required. The vulnerability is documented in the DarkBoulder CVE-Vendor-Coordination TOTOLINK entry and the parallel ShengWu00 CVE-Vendor-Coordination TOTOLINK entry.
No verified proof-of-concept code is published in the referenced advisories. See the security advisories for topic details and message structure.
Detection Methods for CVE-2026-51767
Indicators of Compromise
- Unexpected reboots of TOTOLINK T6 devices with loss of pairing state.
- MQTT PUBLISH traffic reaching the cs_broker component from unmanaged or external hosts.
- Repeated device unavailability windows correlating with inbound traffic to MQTT ports (typically 1883/tcp or 8883/tcp).
Detection Strategies
- Monitor network flows for MQTT traffic destined for TOTOLINK T6 management interfaces from non-administrative sources.
- Inspect router event logs for repeated pairing-reset events or reboot cycles without corresponding administrative actions.
- Alert on connections to the cs_broker service from clients outside the pairing workflow.
Monitoring Recommendations
- Baseline the volume and source of MQTT connections to TOTOLINK T6 devices and alert on deviations.
- Track device uptime metrics and generate alerts when TOTOLINK T6 units reboot outside scheduled maintenance windows.
- Correlate router availability drops with firewall logs to identify the originating host of suspicious MQTT sessions.
How to Mitigate CVE-2026-51767
Immediate Actions Required
- Restrict network access to the cs_broker MQTT service so only trusted management hosts can reach the device.
- Segment TOTOLINK T6 routers onto isolated management VLANs and block MQTT ports at perimeter and internal firewalls.
- Inventory deployed TOTOLINK T6 units and confirm which are running firmware 4.1.5cu.748_B20211015.
Patch Information
At the time of publication, no fixed firmware version is referenced in the NVD entry. Monitor the TOTOLINK official website and the TOTOLINK download page for the T6 for firmware updates addressing CVE-2026-51767. Apply the vendor-supplied firmware as soon as it becomes available.
Workarounds
- Block inbound traffic to MQTT ports (1883/tcp, 8883/tcp) on all interfaces exposing the TOTOLINK T6.
- Disable remote management features that are not required for the deployment.
- Place vulnerable devices behind a firewall that enforces source-address allowlisting for management protocols.
- Replace end-of-support TOTOLINK T6 units where the vendor does not release a firmware fix.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.