EUVD-2026-69204
GHSA-6crr-f4rp-973c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain LAN/mesh network access
-
DeliveryCraft MQTT message for cs_broker
-
ExploitInvoke delSlaveDevice unauthenticated
-
ExecutionRemove target slave from mesh data
-
ImpactRouter reboots, mesh disrupted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6's cs_broker MQTT component and the ability to publish a crafted MQTT message invoking delSlaveDevice - no credentials, no user interaction, no non-default configuration is needed for the vulnerable code path itself. Limiting factor: the operation is described as acting on 'local mesh management,' so in a default deployment the attacker generally needs to be on the LAN/adjacent mesh network rather than the public internet, unless the MQTT broker port has been exposed to the WAN. Only firmware 4.1.5cu.748_B20211015 is confirmed affected. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) marks this critical, but the confidentiality claim (C:H) is not supported by the description: delSlaveDevice removes a device and reboots - it alters state and denies service, it does not read secrets. A more defensible assessment is C:N/I:H/A:H (≈9.1). Contradicting signals: EPSS is only 0.18% (7th percentile) and there is no KEV listing or public PoC, so despite the high CVSS the near-term probability of widespread automated exploitation is low. Realistically this is a genuine unauthenticated integrity/availability issue reachable over the network, but its practical reach depends on whether cs_broker's MQTT port is exposed beyond the LAN - the description says 'local mesh management,' implying an on-network attacker. SSVC-style read: exploitation=none observed, automatable=likely (single unauthenticated message), technical impact=partial-to-total for the device/mesh. Treat as a high-priority LAN/adjacent-network hardening item rather than an internet-wide emergency unless the broker is found internet-exposed. |
| Exploit ScenarioDerived | An attacker with access to the local/mesh network (e.g., a rogue device on the LAN or a compromised host) publishes a crafted MQTT message to the T6's cs_broker invoking delSlaveDevice with a target slave identifier. The broker removes that node from mesh management data and reboots the router, dropping the mesh and any clients relying on the removed node. No authentication or user interaction is required; no public PoC is currently available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated device removal and forced reboot affects the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015), where the delSlaveDevice function in the cs_broker MQTT component accepts crafted messages without authentication. A remote attacker can delete a chosen slave device from the router's local mesh management data and trigger a system reboot, disrupting the mesh network. No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile) and the flaw is not in CISA KEV.
RemediationAI
No vendor-released patched firmware version is identified in the available data; check the TOTOLINK T6 download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for firmware newer than 4.1.5cu.748_B20211015 and apply it once published. As compensating controls: ensure the cs_broker MQTT service is not reachable from the WAN and block/firewall the MQTT broker port at the network perimeter (trade-off: none for WAN, since remote mesh management is not an intended internet-facing feature); segment mesh/IoT devices onto an isolated VLAN so only trusted management hosts can reach cs_broker (trade-off: adds network configuration overhead); and restrict LAN access to the router's management plane to reduce the pool of hosts that can send the crafted MQTT message (trade-off: may complicate legitimate multi-node mesh setup). Monitor for unexpected slave-device removals and unscheduled reboots as indicators.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is cs_broker, an MQTT message broker used internally by TOTOLINK's mesh (multi-node Wi-Fi) management stack to coordinate a 'master' router with 'slave' nodes. MQTT is a lightweight publish/subscribe messaging protocol; here it is exposed such that management commands like delSlaveDevice can be invoked without a client authenticating to the broker. The root cause is CWE-284 (Improper Access Control): the handler performs a privileged state-changing operation - removing an entry from local mesh management data and rebooting - based solely on receipt of a message, with no authorization check tying the request to an authenticated administrator. CPE data is a placeholder ('cpe:2.3:a:n/a:n/a') and does not identify the product; the actual affected product is confirmed by the description and TOTOLINK vendor references to be the TOTOLINK T6 router.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated single MQTT message (AV:N/AC:L/PR:N/UI:N); operation removes mesh data and reboots (I:H/A:H) but reads no secrets, so C:N rather than the vendor's C:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the cs_broker component.
Executive ViewAI
TOTOLINK T6 mesh routers running firmware 4.1.5cu.748_B20211015 can be remotely disabled and removed from mesh networks via unauthenticated MQTT commands, allowing attackers to disrupt network connectivity without credentials. Organizations deploying these devices should immediately inventory affected units and implement network containment while awaiting vendor remediation.
Restrict MQTT broker access via firewall to only trusted internal management networks; segment affected T6 routers to separate VLANs or network zones to contain disruption; disable mesh federation between critical networks and affected devices if operationally feasible; monitor MQTT traffic for anomalous delSlaveDevice commands.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB