Description

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the cs_broker component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-01T14:17:35.290Z",
  "pubdate": "2026-09-01T14:17:35.290Z",
  "executiveSummary": "A critical access control vulnerability exists within the TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The issue specifically resides in the sendStaticInfoToMaster function, which fails to enforce proper authentication or authorization checks when processing incoming messages.\nThis vulnerability allows unauthenticated, remote attackers to manipulate stored slave inventory records by injecting crafted MQTT messages into the cs_broker component. Successful exploitation permits the unauthorized modification of device configuration data, potentially leading to the subversion of master-slave network orchestration and integrity loss within the TOTOLINK mesh environment.\nThe vulnerability represents a significant security risk, as it bypasses standard access control mechanisms. No authentication is required for an attacker to influence the internal inventory state, provided they have network reachability to the MQTT broker utilized by the device. The impact includes persistent state corruption and potential lateral movement or redirection of management traffic within the local network segment.",
  "technicalDetails": "The vulnerability originates from an improper access control implementation in the sendStaticInfoToMaster function. This function is responsible for processing synchronization data intended for the master node within the TOTOLINK T6 mesh ecosystem. The analysis identifies that the function lacks secondary verification logic, such as a cryptographic signature or valid session token, to authenticate the source of the incoming data packets.\nThe vulnerable component is the cs_broker, an MQTT-based messaging intermediary responsible for facilitating communication between slave nodes and the master controller. Because the cs_broker does not implement mutual TLS (mTLS) or robust access control lists (ACLs) to validate the identity of the publisher, it permits any entity capable of sending MQTT messages to reach the targeted topic.\nThe attack flow proceeds as follows: First, the attacker identifies the network reachability of the MQTT broker service running on the TOTOLINK T6 device. Second, the attacker crafts a malicious MQTT payload designed to mimic legitimate static information updates intended for the master node. Third, the attacker publishes this crafted message to the topic monitored by the cs_broker component. Finally, the sendStaticInfoToMaster function, triggered by the arrival of this message, processes the input without validation, directly writing the attacker-supplied parameters into the stored slave inventory records.\nThe exploitation of this flaw allows an attacker to overwrite critical metadata regarding slave nodes. By manipulating the inventory, an attacker can effectively impersonate slave devices, intercept management traffic intended for valid nodes, or cause a denial of service (DoS) by corrupting the master controller’s view of the network topology. The lack of authentication requirements and the reliance on a messaging protocol that is often exposed across local segments significantly lowers the barrier for exploitation. Post-exploitation, the attacker maintains influence over the device state until the service is restarted or the inventory is manually reset, highlighting a persistent impact on system integrity and operational security."
}