Description

Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the cs_broker component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-01T14:17:36.997Z",
  "pubdate": "2026-09-01T14:17:36.997Z",
  "executiveSummary": "A critical access control vulnerability exists in the TOTOLINK T6 mesh networking implementation, specifically within the recvIndirectMeshInfo function. This vulnerability allows an unauthenticated, remote attacker to manipulate mesh neighbor records by injecting or replacing entries via the cs_broker component.\nThe vulnerability stems from insufficient validation of incoming MQTT messages, which are processed without verifying the authenticity or origin of the mesh configuration data. By crafting malicious MQTT packets, an attacker can influence the device's mesh topology routing tables.\nThis flaw impacts TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. Successful exploitation allows an attacker to manipulate the mesh network structure, potentially leading to traffic interception, man-in-the-middle attacks, or denial-of-service conditions by isolating nodes or redirecting sensitive data through unauthorized segments of the mesh.\nThe attack requires network access to the MQTT broker interface managed by the cs_broker component. Given the nature of mesh networking protocols, this represents a significant security risk for the integrity and confidentiality of the internal network traffic within the affected TOTOLINK environment.",
  "technicalDetails": "The vulnerability resides within the recvIndirectMeshInfo function of the TOTOLINK T6 firmware (4.1.5cu.748_B20211015). The function is responsible for parsing and integrating mesh topology updates received via the MQTT protocol, which is managed by the cs_broker system service.\nThe root cause is a failure to implement robust authentication and authorization checks for incoming MQTT messages routed to the mesh information processing routine. The cs_broker component does not perform sufficient validation or sanity checks on the source of these messages, nor does it verify that the originator of the MQTT payload is an authorized mesh node or a trusted administrator.\nThe attack flow begins with the attacker establishing connectivity to the MQTT broker instance utilized by the cs_broker component. Because the interface lacks proper access control, the attacker can publish crafted MQTT messages designed to trigger the recvIndirectMeshInfo function. The payload is engineered to include forged mesh neighbor information, such as MAC addresses, link quality metrics, or node roles.\nWhen the cs_broker component receives the malicious packet, it passes the data to the recvIndirectMeshInfo function. This function proceeds to update the internal mesh neighbor table directly based on the untrusted input. By injecting arbitrary neighbor records, the attacker forces the router to treat unauthorized devices as valid mesh nodes or legitimate routing paths. This results in the corruption of the device's mesh topology database.\nThe impact of this exploitation is severe. By manipulating the neighbor tables, an attacker can effectively redirect traffic flows within the local mesh network. For instance, the attacker could introduce a malicious node into the mesh backbone, facilitating interception of cleartext or weakly encrypted traffic (Man-in-the-Middle). Furthermore, the attacker could cause network instability or complete service disruption by advertising invalid routing paths that create loops or cause packets to be dropped at the node level. This vulnerability is particularly concerning as it bypasses traditional perimeter security, operating at the mesh control plane level to subvert network integrity."
}