CVE-2026-51770 Overview
CVE-2026-51770 is an incorrect access control vulnerability in the sendToMasterQosConfig function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can forward attacker-controlled Quality of Service (QoS) settings to the master node by sending a crafted MQTT message to the cs_broker component. The flaw is categorized under [CWE-284: Improper Access Control] and is exploitable over the network without authentication or user interaction.
Critical Impact
Remote unauthenticated attackers can manipulate router QoS configuration on the master node, compromising confidentiality, integrity, and availability of network traffic management.
Affected Products
- TOTOLINK T6 router
- Firmware version 4.1.5cu.748_B20211015
- cs_broker MQTT component
Discovery Timeline
- 2026-09-01 - CVE-2026-51770 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-51770
Vulnerability Analysis
The vulnerability resides in the sendToMasterQosConfig function inside the TOTOLINK T6 firmware. The function processes MQTT messages received by the cs_broker component without enforcing authentication or authorization checks on the sender. As a result, any network-reachable attacker capable of publishing MQTT messages to the broker can influence QoS configuration forwarded to the master device.
MQTT (Message Queuing Telemetry Transport) is a lightweight publish/subscribe messaging protocol commonly used for device-to-device coordination in mesh and IoT deployments. TOTOLINK T6 uses MQTT internally to synchronize configuration across nodes, and cs_broker acts as the message broker for these control messages.
Because QoS settings shape traffic prioritization and bandwidth allocation, attacker-controlled values can degrade service, redirect priority, or interfere with legitimate traffic paths. The EPSS score at time of publication is 0.442%.
Root Cause
The root cause is missing access control enforcement in the sendToMasterQosConfig handler. The function trusts inbound MQTT payloads without validating the origin, identity, or authorization of the publisher. This maps directly to [CWE-284], where security decisions rely on assumed trust rather than verified authentication.
Attack Vector
An attacker with network access to the cs_broker MQTT interface crafts a message targeting the QoS configuration topic. The broker accepts the message, and sendToMasterQosConfig forwards the attacker-supplied parameters to the master node. No credentials, tokens, or user interaction are required. See the TOTOLINK Coordination Repository for coordination details.
No verified public proof-of-concept code is available at this time. Refer to the TOTOLINK vendor coordination notes for technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-51770
Indicators of Compromise
- Unexpected MQTT PUBLISH messages targeting cs_broker topics related to QoS configuration.
- Sudden or unexplained changes to router QoS policies, including modified traffic prioritization or bandwidth caps.
- MQTT connections from clients outside the expected management subnet.
Detection Strategies
- Inspect network traffic for MQTT (typically TCP 1883 or 8883) originating from unauthorized hosts and directed at TOTOLINK T6 devices.
- Correlate router configuration changes with the identity of the source that triggered them; flag changes lacking an authenticated administrative session.
- Baseline the frequency and content of legitimate cs_broker traffic to detect deviation.
Monitoring Recommendations
- Enable logging on network segments that host TOTOLINK T6 devices and forward logs to a centralized platform for retention and analysis.
- Monitor for repeated connections to MQTT ports from unusual source addresses.
- Alert on QoS policy modifications occurring outside of scheduled maintenance windows.
How to Mitigate CVE-2026-51770
Immediate Actions Required
- Restrict network access to affected TOTOLINK T6 devices, ensuring MQTT ports are not reachable from untrusted networks or the internet.
- Segment IoT and network infrastructure onto isolated VLANs with strict inbound filtering.
- Audit current QoS configurations to identify unauthorized modifications.
Patch Information
No vendor patch is currently referenced in the NVD entry. Check the TOTOLINK Download Page and the TOTOLINK Official Website for firmware updates addressing firmware 4.1.5cu.748_B20211015.
Workarounds
- Block inbound MQTT traffic (TCP 1883/8883) at the network perimeter and between untrusted segments.
- Disable remote management features on the TOTOLINK T6 if not required for operations.
- Place affected devices behind a firewall that enforces allow-listing for management-plane protocols.
# Example: block MQTT traffic to TOTOLINK T6 devices using iptables
iptables -A FORWARD -p tcp --dport 1883 -d <TOTOLINK_T6_IP> -j DROP
iptables -A FORWARD -p tcp --dport 8883 -d <TOTOLINK_T6_IP> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
