CVE-2026-51765 in TOTOLINK
Summary
by MITRE • 09/01/2026
Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the cs_broker component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 represents a critical failure in access control mechanisms within the device's mesh networking subsystem. Specifically, the flaw resides in the recvIndirectMeshInfo function, which is responsible for processing incoming data related to mesh neighbor information. This component interacts with the cs_broker service, an internal message broker that facilitates communication between various modules of the router’s firmware. The core issue stems from a lack of proper authentication and authorization checks when handling MQTT messages directed at this specific endpoint. Consequently, any unauthenticated actor capable of reaching the device over the network can interact directly with this function without providing valid credentials or passing security validation steps.
From a technical perspective, the vulnerability allows an attacker to inject or overwrite mesh neighbor records by sending specially crafted MQTT payloads. Mesh networking relies on accurate and trusted information about neighboring nodes to maintain stable routing paths and ensure seamless connectivity between devices in a mesh topology. By manipulating these records, an adversary can disrupt the logical structure of the network. This could involve inserting fake neighbors with malicious IP addresses or altering existing entries to point towards compromised infrastructure. The ability to modify this data without authentication indicates that the cs_broker component does not enforce strict identity verification for all incoming messages, particularly those affecting critical routing tables.
The operational impact of this vulnerability is severe and multifaceted. First, it enables a denial-of-service condition by corrupting the mesh topology, potentially causing network partitions or complete loss of connectivity among devices in the mesh group. Second, it facilitates man-in-the-middle attacks where traffic can be redirected through an attacker-controlled node due to falsified neighbor information. This allows for passive eavesdropping on sensitive data transmitted across the local area network. Furthermore, if the compromised router is part of a larger enterprise or home automation ecosystem, this breach could serve as a pivot point for lateral movement into other connected devices that trust the mesh infrastructure. The lack of authentication also implies that remote exploitation is possible if the MQTT broker port is exposed to untrusted networks, although local network access is typically required in most default configurations.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment or Lack of Authorization for Critical Function, as well as CWE-749, Exposed Dangerous Method or Function, since the recvIndirectMeshInfo function was made accessible to unauthenticated users without adequate safeguards. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1078, Valid Accounts, although in this case it is more accurately described as exploiting a lack of authentication (T1528 or general access vector exploitation), and specifically relates to network service manipulation similar to T1496 Resource Hijacking if used for crypto-mining via mesh propagation, though primarily here it serves reconnaissance and disruption purposes. The attack vector involves sending crafted MQTT messages, which falls under the category of exploiting messaging protocols often found in IoT environments where security is frequently deprioritized during development.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Users should immediately apply any available firmware updates from TOTOLINK that address this specific access control flaw, as patching is the most effective way to close the authentication gap in the cs_broker component. If an update is not yet available, network segmentation is recommended; placing mesh routers behind a firewall and restricting MQTT port access (typically 1883 or 8883) to only trusted internal subnets can prevent remote exploitation by external actors. Additionally, disabling unnecessary services such as the MQTT broker if it is not actively used for required functionality reduces the attack surface significantly. For administrators managing multiple devices, enforcing strong administrative passwords and ensuring that management interfaces are not exposed to public networks remains a fundamental best practice to complement specific software fixes.