EUVD-2026-69207
GHSA-m6vp-fh75-wqjg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach cs_broker MQTT endpoint on mesh segment
-
DeliveryCraft malicious MQTT heartbeat message
-
ExploitPublish to unauthenticated keepAlive topic
-
ExecutionMaster processes spoofed heartbeat
-
ImpactManipulate mesh coordination state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the cs_broker MQTT endpoint and publish a crafted message that the keepAlive function processes; no authentication or user interaction is required (PR:N/UI:N). The concrete prerequisite is network reachability of the cs_broker component (typically the LAN/mesh control plane rather than the WAN by default), and the target must run TOTOLINK T6 firmware 4.1.5cu.748_B20211015 with mesh/broker functionality active. The limiting factor is broker exposure: if the MQTT service is confined to the internal mesh segment, a purely external attacker cannot reach it, reducing the AV:N assumption to adjacent/local in most deployments. |
| Impact | The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) rates this as critical, but the impact metrics appear overstated relative to the described behavior. The keepAlive function emits/injects heartbeat information toward the master - a write-oriented action against mesh coordination state - with no described data read, so C:H is not supported and full I:H/A:H is generous for a heartbeat-emission primitive. Signals conflict: SSVC marks automatable=yes and technical impact=total, yet EPSS is only 0.18% (7th percentile) and exploitation status is 'none', consistent with no public exploit at analysis time. Practical reachability is the key limiter - MQTT/cs_broker exposure is typically on the LAN/mesh segment, so AV:N is realistic only if the broker port is reachable from the attacker's network position. Net: a genuine unauthenticated access-control gap worth patching, but the real-world impact is closer to mesh-state manipulation than the full-CIA 9.8 implies. |
| Exploit ScenarioDerived | An attacker with access to the router's mesh/LAN segment (for example a compromised Wi-Fi client or a device on the same broker-reachable network) crafts an MQTT message and publishes it to the cs_broker component without any credentials. The message is processed by the keepAlive handler, causing spoofed mesh heartbeat information to be emitted toward the master and manipulating mesh coordination state. No public proof-of-concept is identified, but SSVC flags the technique as automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Unauthenticated mesh-heartbeat injection in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker send a crafted MQTT message to the cs_broker component and cause the keepAlive function to emit indirect mesh heartbeat information toward the mesh master. The flaw is a missing access-control check (CWE-284) on an internal MQTT topic that trusts any client. SSVC rates technical impact as total and exploitation as automatable, but no public exploit is identified and EPSS is low (0.18%, 7th percentile).
RemediationAI
No vendor-released patched firmware version is identified at time of analysis; monitor the TOTOLINK download page (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) and the CVE-Vendor-Coordination trackers for a fixed build newer than 4.1.5cu.748_B20211015. As compensating controls, restrict access to the MQTT/cs_broker service so it is not reachable from untrusted networks: block or firewall the broker's TCP port at the network boundary and on any guest/IoT VLAN (trade-off: mesh nodes on separate segments must still be able to reach it, so segment mesh peers together rather than blocking indiscriminately). Disable mesh mode if the deployment uses the T6 as a standalone router (trade-off: loses mesh roaming/coordination). Place the device behind a router/firewall so the WAN interface never exposes the broker, and isolate the router management/mesh plane from general client traffic.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The T6 is a consumer/SOHO mesh Wi-Fi router. Its inter-node mesh coordination is implemented over an MQTT message bus (the cs_broker component), where mesh nodes exchange state such as keep-alive/heartbeat signals between slaves and the master. The keepAlive handler consumes MQTT messages without authenticating or authorizing the publisher, so any party able to reach the broker can publish messages that are processed as legitimate mesh heartbeat traffic. This is the CWE-284 (Improper Access Control) root cause class: a sensitive control-plane interface is exposed without enforcing who may invoke it. The affected version reported is 4.1.5cu.748_B20211015; the EUVD 'n/a n/a' entry is a placeholder rather than a real product/version pairing.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated MQTT publish, but broker is a mesh/LAN control plane (AV:A) and effect is write-only heartbeat injection affecting mesh state integrity (I:L), with no read (C:N) or clear service loss (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the cs_broker component.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015 and likely earlier versions) are vulnerable to unauthenticated remote mesh-heartbeat information disclosure via an unprotected internal MQTT broker, allowing attackers to extract mesh network topology without credentials. No vendor patch is available, and while real-world exploitation risk remains low (EPSS 0.2%), affected deployments using mesh networking face potential reconnaissance exposure.
Restrict MQTT broker network access via firewall to trusted subnets only; disable remote MQTT access if not operationally required; deploy internal network segmentation to isolate mesh deployments; implement monitoring and alerts for unusual MQTT traffic patterns; evaluate replacing affected routers with vendors providing active security updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB