Description

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the cs_broker component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-01T14:17:36.520Z",
  "pubdate": "2026-09-01T14:17:36.520Z",
  "executiveSummary": "The TOTOLINK T6 router, specifically firmware version 4.1.5cu.748_B20211015, contains an incorrect access control vulnerability within the updateLanIp function.\nThis security flaw allows an unauthenticated, remote attacker to trigger a state refresh of the LAN IP address by sending a malicious message via the MQTT protocol to the cs_broker component.\nThe vulnerability represents a significant risk to device integrity, as it allows unauthorized control over network interface configurations without requiring legitimate administrative credentials.\nThe impact includes potential network disruption, unauthorized reconfiguration of the LAN environment, and potential for man-in-the-middle positioning if the LAN IP is modified to redirect traffic.\nExploitation requires network-level access to the MQTT broker utilized by the device, enabling the attacker to interact with the internal message bus without authorization.",
  "technicalDetails": "The vulnerability resides within the internal messaging handling of the TOTOLINK T6 firmware, specifically involving the cs_broker component. The cs_broker acts as a central communication hub for system functions, including network configuration updates.\nThe root cause is an insufficient access control implementation in the updateLanIp function. This function, responsible for modifying the device's Local Area Network IP address parameters, fails to validate the origin and authorization level of incoming MQTT messages before processing state-changing commands.\nThe attack flow initiates with the attacker identifying the MQTT broker service exposed by the router. Upon establishing communication with the cs_broker, the attacker crafts a malicious MQTT payload designed to invoke the updateLanIp logic.\nBecause the system lacks proper authentication or origin verification for these messages, the firmware treats the attacker's request as a legitimate administrative command. When the payload is received, the updateLanIp function processes the message, resulting in the device modifying its internal LAN address configuration state.\nThis vulnerability is particularly critical as it facilitates unauthorized interaction with low-level configuration functions via a protocol that is often inadequately secured in embedded device environments. An attacker can use this to force the device to update its networking state, potentially causing a denial-of-service condition or transitioning the device to an attacker-controlled subnet environment.\nSince the communication occurs via the MQTT protocol, the attacker does not need to bypass traditional web-based authentication mechanisms, as the vulnerability resides at the messaging middleware layer. This bypasses typical perimeter defenses that focus on HTTP/HTTPS-based administrative interfaces. The interaction is direct, targeting the backend message queue, which the developer likely assumed would only be accessed by trusted internal system services."
}