Description

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the cs_broker component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-01T14:17:36.150Z",
  "pubdate": "2026-09-01T14:17:36.150Z",
  "executiveSummary": "This vulnerability involves an incorrect access control flaw within the TOTOLINK T6 mesh networking firmware, specifically version 4.1.5cu.748_B20211015.\nThe vulnerability resides in the meshSlaveUpgfw function, which is responsible for managing firmware upgrade procedures.\nUnauthenticated remote attackers can leverage the cs_broker MQTT component to trigger unauthorized firmware flashing operations.\nThe primary risk implication is the potential for full device compromise, as an attacker can force the device to flash arbitrary or existing upgrade files without requiring administrative authentication.\nSuccessful exploitation allows an attacker to dictate the device's firmware state, leading to complete loss of integrity and potential persistence via malicious firmware installation.\nThis vulnerability highlights a critical failure in the verification process for inter-process communication via MQTT, effectively bypassing standard web-based or portal-based authentication mechanisms.",
  "technicalDetails": "The vulnerability is localized within the meshSlaveUpgfw function, which improperly validates the source and authenticity of firmware update commands.\nThe attack surface is exposed via the cs_broker component, which facilitates MQTT-based communication within the mesh network architecture.\nThe root cause of this flaw is an absence of authentication checks during the command dispatch phase of the firmware update process. Specifically, the meshSlaveUpgfw function executes flashing routines based solely on the reception of a structured MQTT message, failing to perform a secondary verification of the requestor's authorization level or the integrity of the message source.\nExploitation is conducted by crafting a specific MQTT payload directed at the cs_broker. When the broker processes this message and routes it to the meshSlaveUpgfw handler, the system proceeds to initiate the firmware flashing sequence. Because the function does not gate-keep this operation behind a secure authentication handshake, any entity capable of communicating with the MQTT broker can trigger the update mechanism.\nThe technical attack flow follows these stages: First, an attacker establishes connectivity to the network environment where the cs_broker is reachable. Second, the attacker constructs a malicious MQTT publish operation containing the trigger parameters required by the meshSlaveUpgfw function. Third, the cs_broker propagates this message to the vulnerable function. Finally, the firmware update process commences, potentially replacing the current device firmware with existing upgrade files or malicious payloads if accessible by the update logic.\nThis vulnerability effectively circumvents traditional authentication boundaries. While a user would typically need to authenticate through a web GUI or administrative interface to perform an update, the MQTT interface provides an out-of-band, low-privilege vector to achieve high-privilege administrative actions. The post-exploitation impact is catastrophic, as the device becomes susceptible to firmware-level manipulation, which may facilitate further exploitation, such as the deployment of rootkits or backdoor persistence mechanisms that survive standard reboots."
}