EUVD-2026-69205
GHSA-jr79-fg9q-6hgm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain LAN/mesh network access
-
DeliveryConnect to cs_broker MQTT service
-
ExploitPublish crafted updatePriChannel message
-
ExecutionRouter rescans and switches primary channel
-
ImpactWireless service disruption
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the ability to reach the T6's internal cs_broker MQTT service and send it a crafted message invoking updatePriChannel; no authentication or user interaction is needed. The practical limiting factor is reachability of that MQTT bus - it is a mesh-fabric component typically exposed on the LAN/mesh side rather than the WAN, so an attacker generally needs a foothold on the local or mesh network (or a device with the broker inadvertently exposed externally). The affected build is specifically firmware 4.1.5cu.748_B20211015 of the TOTOLINK T6. |
| Impact | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) treats this as a full confidentiality/integrity/availability compromise, but the described action - rescanning and switching the primary mesh channel - is a write-only control operation with no data-read path, so confidentiality impact (C:H) is overstated; the realistic impact is integrity/availability disruption of the wireless service. Signals conflict: the 9.8 score and unauthenticated network vector imply a top-tier emergency, yet the EPSS probability is only 0.18% (7th percentile) with no KEV listing and no public PoC, which points to low real-world exploitation pressure. A further caveat is reachability - MQTT/cs_broker is typically an internal mesh-fabric bus rather than a WAN-facing service, so 'network' exploitation in practice usually means an attacker already on the LAN or mesh segment, which tempers the AV:N assumption; even a mid-sized municipal IT team in legnica should still patch promptly, but the practical urgency is disruption of Wi-Fi service rather than data theft. Net: a genuine unauthenticated access-control defect worth remediating on exposed devices, but not the widespread-mass-exploitation emergency the raw 9.8 suggests. |
| Exploit ScenarioDerived | An attacker with access to the router's LAN or mesh segment connects to the cs_broker MQTT service and publishes a crafted message targeting updatePriChannel, with no authentication step in the way. The device rescans and switches its primary mesh channel, disrupting or degrading wireless connectivity for all clients; repeated messages can be used to cause sustained instability. No public PoC is currently known, but the attack requires only the ability to send one MQTT message. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated mesh-channel manipulation in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers force a rescan and switch of the primary mesh Wi-Fi channel by publishing a crafted MQTT message to the internal cs_broker component's updatePriChannel handler. No credentials are required, and no public exploit is identified at time of analysis; EPSS is low (0.18%, 7th percentile), indicating limited observed exploitation interest despite the high CVSS score.
RemediationAI
No vendor-released patched firmware version is identified at time of analysis; the referenced TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) should be monitored for a build newer than 4.1.5cu.748_B20211015, and the coordination trackers (https://github.com/DarkBoulder/CVE-Vendor-Coordination and https://github.com/ShengWu00/CVE-Vendor-Coordination TOTOLINK READMEs) watched for fix status. As compensating controls, ensure the MQTT/cs_broker service is never reachable from the WAN and restrict it to trusted mesh nodes only - block external access to the MQTT port at the network edge (trade-off: none for typical home use, since this bus is meant to be internal); segment the router's management/mesh plane away from untrusted LAN clients and guest networks (trade-off: may require reconfiguring guest isolation); and if the model permits, disable remote management. Where feasible, replace end-of-support hardware, as this device line has a history of unpatched access-control flaws.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The T6 is a consumer/SOHO mesh Wi-Fi router. Its mesh nodes coordinate over an internal MQTT bus served by a component named cs_broker; the updatePriChannel function acts on messages to that broker to rescan and reassign the primary radio channel used across the mesh. The flaw is CWE-284 (Improper Access Control): the MQTT command path performs the privileged channel-switch action without authenticating or authorizing the requester, so any party able to reach the broker can invoke it. This is the same class of MQTT-bus access-control defect seen across the T6 sibling advisories (e.g. freeStaClient, sendToMasterQosConfig, updatePriChannel) where cs_broker handlers trust unauthenticated messages.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
MQTT mesh bus is realistically adjacent (AV:A) and unauthenticated; a write-only channel switch alters config (I:L) and disrupts Wi-Fi (A:L) with no data read (C:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the cs_broker component.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015) can be remotely disrupted by unauthenticated attackers through MQTT message injection to force mesh Wi-Fi channel switching, affecting any organization deploying TOTOLINK T6 mesh networks for primary connectivity. No patch is available, and while observed exploitation is minimal, the ease of attack and lack of mitigation path creates significant availability risk.
No vendor-released patch identified at time of analysis. Interim mitigations: block external access to MQTT ports via firewall rules, disable MQTT functionality if not required for operations, use network segmentation to restrict management traffic, and implement traffic monitoring to alert on suspicious MQTT channel-manipulation commands.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB