CVE-2026-51747 in TOTOLINK
Summary
by MITRE • 09/01/2026
Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the cs_broker component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in the TOTOLINK T6 router, specifically within firmware version 4.1.5cu.748_B20211015, represents a critical failure in access control mechanisms governing the keepAlive function of its mesh networking subsystem. This flaw allows unauthenticated attackers to interact with internal system components that should be restricted to authorized processes or authenticated users. The core technical issue lies within the cs_broker component, which serves as the central message broker for MQTT communications within the device's local network management architecture. By sending a specifically crafted MQTT message targeting this component, an attacker can bypass authentication requirements and inject indirect mesh heartbeat information directly toward the master node of the mesh network. This capability undermines the fundamental security assumption that internal control plane traffic is isolated from external or untrusted sources, effectively allowing remote manipulation of network topology state without valid credentials.
From a technical perspective, the keepAlive function is designed to maintain connectivity status between nodes in a wireless mesh network by periodically exchanging heartbeat signals. These signals are critical for determining node availability and routing path integrity. The vulnerability arises because the cs_broker fails to validate the source or permissions of incoming MQTT messages before processing them as valid heartbeat data. This lack of input validation and authorization checks enables an attacker, who may be on the same local network segment or potentially remote if other vulnerabilities exist in the management interface, to forge these packets. The crafted message mimics legitimate system traffic but is injected by an external entity, causing the master node to incorrectly update its view of the mesh topology based on false data provided by the attacker rather than authentic nodes.
The operational impact of this vulnerability is significant for network stability and security integrity. By emitting indirect mesh heartbeat information, an attacker can manipulate the perceived status of other nodes in the mesh. This could lead to a denial-of-service condition where legitimate nodes are marked as offline or unreachable due to conflicting or malformed heartbeat data, causing routing loops or complete loss of connectivity within the affected area. Furthermore, this manipulation can facilitate more sophisticated attacks such as man-in-the-middle scenarios by forcing traffic through compromised nodes that appear valid in the manipulated topology map. The ability to alter mesh state without authentication also compromises the integrity of network management operations, potentially allowing for persistent disruption of service or preparation for further exploitation within the local area network infrastructure.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if default credentials are leveraged to reach the initial attack surface, though the primary flaw is the lack of authorization checks on specific API endpoints or internal functions. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1046 Network Service Discovery and potentially T1572 Protocol Tunneling if the MQTT traffic is used to exfiltrate data or establish covert channels. It also relates to T1498 Network Denial of Service through resource exhaustion or logical manipulation of network state. To mitigate this risk, users should immediately update their TOTOLINK T6 firmware to a patched version that enforces strict authentication and authorization checks on the cs_broker component's MQTT interface. Additionally, implementing network segmentation to isolate mesh control plane traffic from general user data networks can limit the blast radius if such an attack is attempted. Security administrators should also monitor for unusual MQTT traffic patterns originating from untrusted sources within their local subnet as a detection mechanism for ongoing exploitation attempts.