CVE-2026-51768 Overview
CVE-2026-51768 is an incorrect access control vulnerability in the setElinkQosConfig function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can modify privileged Quality of Service (QoS) policy on the master device by sending a crafted Message Queuing Telemetry Transport (MQTT) message to the cs_broker component. The vulnerability is categorized under [CWE-284] Improper Access Control and impacts the integrity of affected TOTOLINK T6 routers without requiring authentication or user interaction.
Critical Impact
Remote unauthenticated attackers can tamper with privileged QoS configuration on TOTOLINK T6 mesh master devices over the network, undermining traffic policy enforcement across the local network.
Affected Products
- TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015
- setElinkQosConfig handler within the device firmware
- cs_broker MQTT component running on the master device
Discovery Timeline
- 2026-09-01 - CVE-2026-51768 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-51768
Vulnerability Analysis
The TOTOLINK T6 mesh router exposes an internal MQTT broker (cs_broker) used by mesh nodes to exchange configuration and telemetry. The setElinkQosConfig function processes messages that configure QoS policy on the master device. The function does not verify the identity or authorization of the message publisher before applying the requested policy changes.
Because access control is missing on the message handler, any client able to reach the broker can publish a crafted message that alters privileged QoS state. The impact is limited to integrity of network policy; confidentiality and availability are not directly affected according to the published CVSS vector.
Root Cause
The root cause is missing authorization checks in the setElinkQosConfig handler [CWE-284]. The function trusts inbound MQTT messages consumed from the cs_broker topic without validating that the sender is an authenticated mesh peer or an authorized administrative client. Privileged configuration primitives are reachable through an unauthenticated message path.
Attack Vector
An attacker with network reachability to the cs_broker MQTT service on the master device connects and publishes a crafted message targeting the topic consumed by setElinkQosConfig. The device parses the payload and applies attacker-supplied QoS parameters to the master node. No credentials, prior compromise, or user interaction are required. On networks where the broker port is exposed beyond the intended mesh backhaul, the attack surface extends to the local subnet and any attacker who can route packets to the broker.
No verified public exploit code is available at the time of publication. Refer to the DarkBoulder CVE Vendor Coordination writeup and the ShengWu00 CVE Vendor Coordination writeup for coordination details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-51768
Indicators of Compromise
- Unexpected changes to QoS policy on TOTOLINK T6 master devices, including new bandwidth rules or reprioritized clients that were not configured by an administrator.
- Inbound MQTT connections to the cs_broker service originating from hosts that are not legitimate mesh nodes.
- MQTT PUBLISH frames referencing topics associated with setElinkQosConfig from unauthenticated sources.
Detection Strategies
- Monitor router administration and syslog output for QoS configuration change events that lack a corresponding administrative session.
- Inspect network traffic on the LAN and mesh backhaul for MQTT (default TCP 1883) sessions terminating on TOTOLINK T6 master devices from unexpected clients.
- Baseline the set of MQTT clients that legitimately communicate with cs_broker and alert on deviations.
Monitoring Recommendations
- Capture and retain packet metadata for MQTT traffic on segments that host TOTOLINK T6 devices.
- Track configuration drift on the master device through periodic backup and diff of QoS settings.
- Correlate router log entries with network telemetry to identify configuration changes that follow anomalous MQTT activity.
How to Mitigate CVE-2026-51768
Immediate Actions Required
- Inventory TOTOLINK T6 devices running firmware 4.1.5cu.748_B20211015 and confirm exposure of the cs_broker MQTT service.
- Restrict network access to the MQTT broker so that only legitimate mesh nodes can reach it, using firewall rules or VLAN segmentation.
- Review current QoS policy on affected master devices and revert unauthorized changes.
Patch Information
No fixed firmware version is referenced in the NVD entry at the time of publication. Check the TOTOLINK download page and the TOTOLINK homepage for updated firmware for the T6 model, and apply any release that addresses the setElinkQosConfig access control issue.
Workarounds
- Block inbound connections to the cs_broker MQTT port from client subnets and any untrusted network segments.
- Isolate mesh backhaul traffic on a dedicated VLAN that does not carry general client traffic.
- Disable remote administration and any feature that exposes mesh management services to the WAN interface.
- Replace affected TOTOLINK T6 devices where a vendor patch is unavailable and the exposure cannot be mitigated through network controls.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
