CVE-2026-51754 in TOTOLINK
Summary
by MITRE • 09/01/2026
Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the cs_broker component.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 represents a critical failure in access control mechanisms within the device's network management subsystem. Specifically, the flaw resides in the updateSlaveIpList function, which is responsible for maintaining the inventory of slave IP addresses used by the router to manage connected devices or downstream nodes. This component interacts with an MQTT broker service, cs_broker, which handles message routing and state updates via the Message Queuing Telemetry Transport protocol. The core issue arises because this specific API endpoint does not enforce proper authentication checks before processing incoming messages that modify critical network configuration states. Consequently, any actor capable of reaching the device over the local network or through exposed MQTT ports can interact with this function without providing valid credentials.
From a technical perspective, the absence of access control allows unauthenticated attackers to send crafted MQTT payloads directly to the cs_broker component. These malicious messages are designed to manipulate the internal data structures that track slave IP addresses. By injecting false entries or overwriting existing ones, an attacker can effectively rewrite the device's view of its network topology. This capability goes beyond simple information disclosure; it constitutes a direct modification of system state. The vulnerability aligns with CWE-269, which classifies Improper Privilege Control, as well as CWE-732, concerning Incorrect Permission Assignment for Critical Resource. In many IoT architectures, the ability to alter IP assignments is tied to DHCP server configurations or static routing tables, making this a high-severity flaw that impacts the integrity of network operations.
The operational impact of this vulnerability is significant and multifaceted. An attacker who successfully exploits this weakness can disrupt normal network connectivity for legitimate users by corrupting the slave IP inventory. This could lead to denial-of-service conditions where devices are assigned incorrect IPs, fail to obtain addresses via DHCP, or experience intermittent connectivity issues due to conflicting lease entries. Furthermore, if the router relies on accurate device tracking for security policies such as parental controls, firewall rules, or intrusion detection systems, corrupting this data can bypass those protections entirely. In more advanced attack scenarios, an attacker might use this state corruption as a stepping stone to perform man-in-the-middle attacks by redirecting traffic through malicious nodes they have injected into the IP list, thereby compromising user privacy and data integrity across the local network segment.
This vulnerability is also relevant to the MITRE ATT&CK framework under techniques related to Defense Evasion and Impact, specifically those involving resource hijacking or service disruption via configuration manipulation. The exploitation vector typically requires lateral movement within a trusted network zone if MQTT ports are not exposed externally, but it remains dangerous for any insider threat or compromised host on the same subnet. Mitigation strategies should prioritize immediate firmware updates provided by TOTOLINK that patch this specific access control gap in the updateSlaveIpList function. If an upgrade is not immediately available, administrators should restrict network access to the MQTT broker port using firewall rules, ensuring only trusted management stations can communicate with cs_broker. Additionally, enabling mutual TLS authentication for MQTT connections and implementing strict input validation on all API endpoints handling state changes are essential hardening measures to prevent similar exploitation vectors in IoT devices.