Description

Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the cs_broker component..

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-01T16:17:05.177Z",
  "pubdate": "2026-09-01T16:17:05.177Z",
  "executiveSummary": "The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015) contains a critical access control vulnerability within its QoS configuration management mechanism. The flaw resides in the sendToMasterQosConfig function, which fails to adequately validate or authorize incoming MQTT messages directed at the cs_broker component. This vulnerability allows an unauthenticated, remote attacker to manipulate Quality of Service (QoS) settings by injecting malicious payloads. Successful exploitation permits the unauthorized modification of device configuration parameters, potentially leading to network traffic manipulation, denial of service, or the disruption of master-slave device synchronization protocols. Given the lack of authentication required for the cs_broker interface, the attack surface is exposed to any actor with network connectivity to the broker. This security failure underscores a lack of robust input validation and authorization checks within the device's message handling architecture, posing significant operational risks to affected network environments.",
  "technicalDetails": "The vulnerability is situated within the communication pipeline between the cs_broker component and the internal device logic responsible for QoS management. The primary function affected, sendToMasterQosConfig, is responsible for processing QoS configuration updates transmitted over the MQTT protocol. A fundamental security flaw exists in this function: the absence of rigorous authorization checks, which allows the function to process configuration packets regardless of the source's authentication state.\nThe attack flow begins when an attacker identifies the cs_broker service listening on the device. Because the service does not enforce authentication, an unauthenticated attacker can craft a malicious MQTT message containing unauthorized QoS configuration parameters. When this message is dispatched to the cs_broker, the system routes the payload to the sendToMasterQosConfig function for processing. Since the function lacks sufficient logic to verify the integrity or origin of the request, it treats the incoming data as a legitimate administrative command.\nUpon receiving the forged MQTT message, the affected device updates its internal QoS configuration state based on the attacker-supplied parameters. This allows for the arbitrary modification of traffic prioritization rules, bandwidth allocation, or other network-shaping behaviors defined within the master device's configuration. By successfully injecting these settings, an attacker can influence the device's operational behavior without requiring any valid credentials. The scope of impact is primarily limited to the manipulation of the QoS engine, yet this behavior may be leveraged as a precursor to more complex attacks, such as traffic interception, traffic shaping for data exfiltration, or the intentional degradation of network throughput resulting in a Denial of Service (DoS) for authorized traffic.\nThe vulnerable component, cs_broker, appears to rely on a trust-based message delivery model that does not adequately isolate management traffic from untrusted sources. This exposure is exacerbated by the lack of mutual authentication between the broker and message originators. Consequently, any actor capable of interacting with the broker component on the network can successfully execute this exploit, demonstrating a failure in secure architectural design regarding the interaction between message-oriented middleware and critical system configuration functions."
}