CVE-2026-51751 in TOTOLINK
Summary
by MITRE • 09/01/2026
Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the cs_broker component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 represents a critical failure in access control mechanisms within the device's mesh networking management subsystem. Specifically, the flaw resides in the delSlaveDevice function, which is responsible for removing slave devices from local mesh management data and triggering system reboots. This component interacts with an MQTT broker service known as cs_broker, which handles communication between network nodes. The core issue stems from a lack of proper authentication or authorization checks when processing requests to delete slave device entries. Consequently, any entity capable of reaching the MQTT endpoint can execute this administrative function without providing valid credentials, effectively bypassing security controls designed to protect configuration integrity and system stability.
From a technical perspective, an unauthenticated attacker who has network access to the affected router's management interface or exposed services can exploit this flaw by crafting specific MQTT messages directed at the cs_broker component. By sending these maliciously constructed packets, the attacker instructs the device to remove designated slave devices from its mesh topology database and subsequently reboot the entire system. This capability allows for both denial of service through forced reboots and potential disruption of network connectivity as dependent nodes are unexpectedly removed from the mesh structure. The ability to manipulate mesh configuration remotely without authentication highlights a significant gap in the implementation of secure communication protocols within the IoT device's firmware architecture, particularly regarding how administrative commands are validated before execution.
The operational impact of this vulnerability is severe for users relying on TOTOLINK T6 devices for stable home or small business networking environments. The forced reboot capability can lead to intermittent connectivity issues and service outages, disrupting dependent applications that rely on continuous network availability. Furthermore, the unauthorized removal of slave devices from mesh management data can cause fragmentation in the wireless network topology, leading to degraded performance and potential loss of coverage areas previously managed by those nodes. Attackers could also use this vulnerability as a stepping stone for further exploitation if other services are running with elevated privileges or if the reboot cycle exposes additional attack surfaces during system initialization phases.
This flaw aligns closely with CWE-284, which describes Improper Access Control vulnerabilities where insufficient checks allow unauthorized actors to perform privileged actions. Additionally, it maps to MITRE ATT&CK techniques related to Resource Hijacking and Denial of Service via service disruption, as well as potential lateral movement within a local network if the mesh topology is compromised. To mitigate this risk, users should immediately update their TOTOLINK T6 firmware to the latest available version that addresses these access control deficiencies. Network administrators are also advised to restrict MQTT broker ports from external or untrusted networks using firewall rules and ensure that management interfaces are not exposed to public internet spaces until patches are applied. Regular monitoring of network logs for unusual MQTT traffic patterns can help detect attempted exploitation in real-time while patching strategies are implemented across the infrastructure.