TOTOLINK T6 CVE-2026-51768

The cs_broker MQTT broker port must be reachable from the attacker's network; if cs_broker binds only to the LAN interface (typical for SOHO routers in default configuration), exploitation is constrained to attackers with local network access. The specific affected firmware is 4.1.5cu.748_B20211015 - other firmware versions have not been confirmed vulnerable or safe. The eLink QoS feature and MQTT broker must be active. No authentication credentials, prior system access, or special tooling are required beyond a standard MQTT client. Exploitation is limited strictly to QoS policy modification (integrity); no confidentiality exposure or direct availability disruption is a consequence of this vulnerability alone.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) yields a score of 7.5 High, reflecting a trivially exploitable network path with no authentication required and no technical complexity, but bounded impact - confined to integrity (QoS policy overwrite) with no confidentiality or direct availability consequence at the CVSS level. EPSS at 0.18% (7th percentile) is very low, consistent with the absence of public exploit code and no CISA KEV listing, suggesting this has not attracted active exploitation interest at time of analysis. Real-world risk is moderate-to-low in absolute terms: the exploit requires only MQTT connectivity and a crafted publish message, making it accessible even to low-skill attackers, yet the practical operational consequence is limited to degrading or manipulating network QoS - even a mid-sized municipal IT team in bytom managing WAN infrastructure through TOTOLINK devices should treat this as a patching priority if the MQTT port is exposed beyond the LAN boundary. If cs_broker is LAN-only (likely for a SOHO router in default config), network exposure is naturally constrained, which significantly lowers real-world exploitation probability relative to the CVSS AV:N framing.

An attacker with network access to the TOTOLINK T6's cs_broker MQTT service connects as an anonymous MQTT client and publishes a crafted message targeting the setElinkQosConfig topic with attacker-chosen QoS parameters. The router applies the malicious policy to the master device without any authentication check, potentially throttling critical traffic classes, elevating low-priority flows, or disrupting QoS-dependent services. No public exploit code has been confirmed, but the attack requires only a standard MQTT client library and knowledge of the target MQTT topic, placing it well within reach of a low-skill attacker.