Description

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the cs_broker component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-01T13:19:45.503Z",
  "pubdate": "2026-09-01T13:19:45.503Z",
  "executiveSummary": "This vulnerability involves an incorrect access control flaw within the TOTOLINK T6 (version 4.1.5cu.748_B20211015) firmware, specifically residing in the updatePriStaList function. The defect allows unauthenticated remote attackers to trigger sensitive administrative operations by interacting with the cs_broker component via the MQTT protocol.\nThe primary impact of this vulnerability is the unauthorized execution of the primary station list refresh process. By bypassing authentication mechanisms, an attacker can force the device to reprocess its internal station list, potentially causing service instability or impacting the device's ability to maintain existing wireless client associations.\nThe risk is categorized as high due to the lack of requirement for prior authentication, enabling remote exploitation over the network. This exposes the device to state-manipulation attacks, which can be leveraged as part of a broader denial-of-service (DoS) or reconnaissance campaign against the local network infrastructure.",
  "technicalDetails": "The vulnerability originates from insufficient access control logic within the updatePriStaList function, which manages the device's primary station list cache. In the TOTOLINK T6 firmware version 4.1.5cu.748_B20211015, the cs_broker component acts as a message broker for internal system tasks, including those exposed through the MQTT protocol.\nThe root cause is the failure of the cs_broker to validate the identity of entities sending MQTT messages to the system. Specifically, the function updatePriStaList assumes that any MQTT message routed to its topic is implicitly authorized by an authenticated administrative session. Because there is no cryptographic verification or session-token validation enforced by the cs_broker before processing the incoming MQTT payload, an attacker can inject malicious or unauthorized packets directly into the message queue.\nThe attack flow proceeds as follows: 1) The attacker discovers the specific MQTT topic managed by the cs_broker that triggers the updatePriStaList execution. 2) The attacker constructs a crafted MQTT message designed to interface with the internal function logic. 3) The attacker transmits this crafted payload to the target TOTOLINK T6 device over the network. 4) The cs_broker receives the message and, due to the lack of access control, proceeds to invoke updatePriStaList with the attacker-supplied parameters.\nUpon execution, the updatePriStaList function performs a refresh of the primary station list. While the direct payload effect is the refreshing of the list, this behavior can be repeatedly triggered to induce resource exhaustion or to force the device to disconnect connected clients as it re-evaluates the station registry. Because the device does not enforce authentication at the broker level, this represents a complete bypass of the administrative management plane for this specific functionality. This vulnerability highlights a critical lack of hardening in the internal inter-process communication (IPC) facilitated by the MQTT protocol within the firmware stack."
}