Description

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-01T14:17:36.757Z",
  "pubdate": "2026-09-01T14:17:36.757Z",
  "executiveSummary": "The TOTOLINK T6 router, specifically firmware version 4.1.5cu.748_B20211015, contains a critical access control vulnerability located within the freeStaClient function.\nThis vulnerability allows unauthenticated, remote attackers to forcibly terminate active wireless client sessions.\nThe flaw resides in the cs_broker component, which fails to adequately validate the source and authorization of incoming MQTT messages.\nBy crafting a malicious MQTT payload, an attacker can trigger the freeStaClient function to disconnect legitimate users from the network, resulting in a denial-of-service condition for impacted clients.\nThe attack requires no prior authentication, significantly lowering the barrier for exploitation by unauthorized actors on the same network segment or reachable via exposed broker interfaces.\nRisk implications include persistent disruption of connectivity, potential man-in-the-middle opportunities post-disconnection, and unauthorized management of wireless resources.",
  "technicalDetails": "The vulnerability originates from inadequate input validation and authentication checks within the cs_broker process of the TOTOLINK T6 firmware version 4.1.5cu.748_B20211015.\nThe cs_broker component serves as the intermediary for MQTT-based internal communications used to manage network states, including the status of associated wireless clients.\nThe core of the issue lies in the freeStaClient function, which lacks internal mechanisms to verify that an incoming request to disconnect a wireless client originated from a trusted or authenticated source.\nAn attacker can exploit this by crafting a specifically formatted MQTT message targeting the relevant broker topic associated with client management.\nBecause the MQTT broker does not enforce rigorous access control lists (ACLs) or authentication for these control messages, the message is processed by the device as a legitimate administrative command.\nUpon receiving the malicious message, the cs_broker invokes the freeStaClient function, passing the target client identifier or MAC address as an argument.\nThe function proceeds to execute the disconnection routine, abruptly terminating the wireless link between the target client and the access point.\nThe exploitation flow is as follows: 1) The attacker identifies reachable MQTT services on the device. 2) The attacker crafts an MQTT publish message intended for the client control topic. 3) The message is injected into the broker without authentication. 4) The cs_broker component receives the payload and passes it to the vulnerable freeStaClient function. 5) The device kernel or management daemon executes the command to drop the client session.\nThis vulnerability highlights a failure in secure inter-process communication (IPC) design, where administrative control functions are exposed to the broker interface without secondary verification.\nImpacts include immediate loss of connectivity for the target client, which can be sustained indefinitely by an attacker re-sending the payload, effectively implementing a wireless denial-of-service attack.\nThe vulnerability is exposed to any network entity capable of communicating with the cs_broker component, which in many TOTOLINK configurations may be accessible via the local area network or insufficiently firewalled interfaces."
}