EUVD-2026-69200
GHSA-9qxh-35cv-gh5r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach cs_broker MQTT bus
-
DeliveryPublish crafted meshSlaveUpdate message
-
ExploitHandler skips auth check
-
ExecutionSlave starts firmware download/flash
-
ImpactMalicious image or brick/reboot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to send a crafted MQTT message to the cs_broker component of a TOTOLINK T6 running firmware 4.1.5cu.748_B20211015, targeting the meshSlaveUpdate handler; no credentials or user interaction are needed since the handler performs no access-control check. The practical limiting factor is network reachability of the cs_broker MQTT bus - if the broker is bound only to the internal mesh backhaul/LAN rather than the WAN, the attacker must already be on that segment, which materially narrows exposure below what the AV:N rating suggests. Full malicious-firmware integrity impact additionally depends on the attacker being able to influence the firmware source the slave downloads. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) treats this as trivially remote and unauthenticated. That reflects the missing access control, but the C:H rating is questionable: meshSlaveUpdate is a write/trigger action (start a firmware download/flash), not a data-read path, so confidentiality impact is not demonstrated - an assessed C:N/I:H/A:H (~9.1) fits better. The most credible high-impact outcomes are integrity (malicious firmware push if the download source can be influenced) and availability (device reboot/brick during flash). Real-world exploitability depends on reachability of the cs_broker MQTT bus: if it is only bound to the mesh LAN/backhaul, network exposure is far narrower than AV:N implies - verify whether the broker is reachable from the WAN or general LAN. Signals conflict on urgency: EPSS is low (0.18%) and there is no KEV listing or public exploit, so this is a serious design flaw but not evidence of imminent mass exploitation. |
| Exploit ScenarioDerived | An attacker with reach to the TOTOLINK T6 mesh MQTT bus (e.g. a malicious device on the LAN/mesh segment, or via the WAN if the broker is exposed) publishes a crafted MQTT message that the cs_broker routes to meshSlaveUpdate. The slave node accepts it without authentication and begins a firmware download/flash workflow, letting the attacker force an update from a source they influence or repeatedly reboot the node into a denial of service. No public PoC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated firmware-workflow abuse in TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) lets a remote attacker start a firmware download or flash operation on a mesh slave device by publishing a crafted MQTT message to the cs_broker component. The meshSlaveUpdate handler performs no authentication or access-control check on the inbound message, so any party able to reach the broker can trigger the slave update workflow. No public exploit was identified at time of analysis, and EPSS is low (0.18%, 7th percentile).
RemediationAI
No vendor-released patched firmware version is identified in the available data, so track the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) and apply an updated T6 firmware once published. As compensating controls: ensure the cs_broker MQTT service is not reachable from the WAN and restrict it to the trusted mesh backhaul only (block/firewall the MQTT port on LAN and internet-facing interfaces); if the mesh feature is not used, disable mesh/slave functionality to remove the update workflow entirely - trade-off is loss of multi-node roaming. Segment the router management/mesh network away from untrusted clients so guest or IoT devices cannot publish to the broker. Because the flaw is in message-level authorization, network-layer restriction is the only effective mitigation until firmware fixes the missing access-control check. Consult the coordination writeups at the DarkBoulder and ShengWu00 GitHub repositories for status.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected device is the TOTOLINK T6 mesh Wi-Fi router. Its mesh nodes coordinate over an internal MQTT message bus served by the cs_broker component; the meshSlaveUpdate function is the handler that a master node uses to instruct a slave node to fetch and apply firmware. The root cause is CWE-284 (Improper Access Control): the handler acts on MQTT messages without verifying that the publisher is an authenticated/authorized master, so a spoofed or externally injected message is treated as a legitimate update command. Because a firmware flash workflow can overwrite the running image and forces a reboot, an attacker who also controls the fetched image content could push arbitrary firmware, while a malformed or interrupted flash can brick or knock the slave offline. The CPE in the record (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not identify the real product, which is TOTOLINK T6.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated MQTT message with no access check (AV:N/AC:L/PR:N/UI:N); a firmware flash trigger is write/state-changing so C:N, with high integrity and availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the cs_broker component.
Executive ViewAI
TOTOLINK T6 mesh routers in firmware version 4.1.5cu.748_B20211015 allow unauthenticated remote attackers to trigger firmware downloads or flashing, enabling complete device takeover without any authentication. No vendor patch is currently available. While no public exploit has been identified at time of analysis, successful exploitation would grant attackers full control over network perimeter infrastructure, risking exposure of all network traffic and potential lateral movement into internal systems.
No vendor-released patch identified at time of analysis. Interim mitigations include: network segmentation restricting router access to authorized networks only, MQTT broker authentication and access controls to prevent unauthorized firmware update messages, real-time monitoring and alerting on firmware update requests, and maintenance of offline recovery procedures in case of unauthorized device compromise. These controls reduce the exploitation surface but do not eliminate the underlying vulnerability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB