Description

Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the cs_broker component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-01T13:19:45.280Z",
  "pubdate": "2026-09-01T13:19:45.280Z",
  "executiveSummary": "The TOTOLINK T6 router (version 4.1.5cu.748_B20211015) contains an improper access control vulnerability within its guest_wifi_sync function. This flaw resides within the cs_broker component, which handles MQTT messaging.\nThe vulnerability allows an unauthenticated, remote attacker to perform an unauthorized administrative action by sending a specifically crafted MQTT message to the broker. By exploiting this flaw, the attacker can force the device to disable guest virtual AP interfaces, effectively causing a denial-of-service for guest wireless connectivity.\nThe primary risk implication is the degradation of network services and the bypass of established security constraints regarding interface management. Because the communication channel lacks sufficient authentication or authorization validation, the system fails to verify the origin or legitimacy of control signals sent via the MQTT protocol.\nThis vulnerability is particularly critical due to the lack of required authentication for exploitation. Attackers located on the same network segment as the broker can interact with the message queue to manipulate device state without credentials, making it a significant threat to internal network management and availability.",
  "technicalDetails": "The vulnerability exists in the guest_wifi_sync function, which is responsible for synchronizing guest wireless configurations within the TOTOLINK T6 firmware (4.1.5cu.748_B20211015). The mechanism relies on the cs_broker component to facilitate inter-process or inter-device communication using the MQTT (Message Queuing Telemetry Transport) protocol.\nThe root cause of this vulnerability is the absence of robust access control checks or message signing/validation within the cs_broker architecture. When the broker receives an MQTT message, the internal logic fails to ensure that the sender is an authorized entity before processing the payload within the guest_wifi_sync function context.\nAn attacker can exploit this by crafting an MQTT message that conforms to the expected structure but contains parameters specifically designed to trigger the disabling of the guest virtual AP interface. Because the cs_broker process operates with elevated privileges to perform system configuration changes, the guest_wifi_sync function executes these malicious instructions without challenging the request's validity.\nThe attack flow follows a predictable sequence: First, the attacker connects to the MQTT broker hosted by the target device. Second, the attacker publishes a maliciously crafted message to the specific topic that the cs_broker subscribes to for synchronization commands. Third, the cs_broker ingests this payload and forwards it to the guest_wifi_sync function. Finally, the function interprets the payload as a legitimate administrative command and modifies the system's wireless interface configuration, resulting in the termination of guest AP services.\nSince the MQTT protocol in this implementation does not mandate authentication, the attack is effective from any node capable of reaching the broker port. This exposes the device to unauthorized state changes. The post-exploitation impact is a persistent disruption of the guest network, which remains down until a manual administrative intervention restores the interface configuration. There is no requirement for prior credentials or user interaction, placing the device at high risk if the MQTT broker is exposed to untrusted network segments."
}