CVE-2026-51745 in TOTOLINK
Summary
by MITRE • 09/01/2026
Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the cs_broker component.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015 represents a critical failure in access control mechanisms within the device's internal communication architecture. Specifically, the flaw resides in the updatePriStaList function, which is responsible for managing and refreshing the list of primary connected stations on the network. This component interacts with an MQTT broker service, designated as cs_broker, to receive updates regarding client connectivity status. The core issue stems from a lack of proper authentication or authorization checks when processing incoming messages intended for this specific function. Consequently, any entity capable of reaching the MQTT endpoint can trigger state changes without providing valid credentials or possessing legitimate administrative privileges. This misconfiguration effectively bypasses the security boundaries designed to protect sensitive network management operations, allowing unauthenticated actors to manipulate internal device states remotely.
From a technical perspective, the exploitation vector involves sending a crafted Message Queuing Telemetry Transport message directly to the cs_broker component. MQTT is commonly used in Internet of Things and smart home devices for lightweight communication between endpoints and servers. In this instance, the application fails to validate whether the sender has the requisite permissions before executing the updatePriStaList logic. This oversight allows an attacker to inject malicious payloads that force the router to refresh its primary station list with arbitrary or malformed data. The ability to manipulate this list can lead to significant disruptions in network stability and security posture. By altering which stations are considered primary, an attacker may potentially interfere with Quality of Service settings, disrupt traffic routing for legitimate users, or create conditions that facilitate further attacks such as man-in-the-middle scenarios if the router's behavior becomes unpredictable during state transitions.
The operational impact of this vulnerability is substantial, particularly in environments where network integrity and availability are paramount. An unauthenticated attacker can cause a denial-of-service condition by repeatedly triggering updates to the station list, potentially exhausting system resources or causing the device to reboot due to internal errors. Furthermore, manipulating the primary station list could allow an adversary to isolate specific devices from the network or redirect their traffic through malicious intermediaries if combined with other vulnerabilities in routing logic. This level of control undermines trust in the router as a secure gateway for home or small business networks. Users may experience intermittent connectivity issues, loss of access to managed IoT devices, or unexpected reboots, all resulting from external actors exploiting this unchecked function call via standard MQTT protocols that are often exposed on local network segments without sufficient segmentation or authentication requirements.
To mitigate the risks associated with this vulnerability, immediate action is required by both manufacturers and end-users. The vendor must release a firmware update that implements strict access control checks within the cs_broker component before invoking the updatePriStaList function. This should include verifying user credentials, validating message origins against trusted sources, and ensuring that only authorized administrative sessions can modify critical network state variables. For users unable to apply an immediate patch, it is advisable to restrict MQTT port accessibility through firewall rules if possible, although this may be challenging in default router configurations where such services are bound locally or exposed on the LAN interface without segmentation. Additionally, changing default administrator passwords and disabling remote management features can reduce the attack surface available to potential exploiters until a permanent fix is deployed by the manufacturer.
This vulnerability aligns with Common Weakness Enumeration category CWE-284, which describes Improper Access Control, as it involves unauthorized modification of system state due to insufficient verification of user privileges. It also maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse or potentially Service Exploitation if the MQTT broker is considered a service component that can be manipulated for lateral movement or persistence in more complex attack chains. The lack of authentication on critical management functions highlights a broader trend in IoT security where convenience often outweighs rigorous access control design, necessitating stricter adherence to secure coding standards and regular third-party security audits for connected devices.