Executive brief
The TOTOLINK T6 mesh router's firmware upgrade component (cs_broker) lacks proper access controls, allowing anyone with network access to trigger firmware flashing without authentication. An attacker can send a specially crafted MQTT message to initiate a firmware upgrade using existing files on the device, potentially disrupting service or installing unauthorized firmware without administrative authorization.
Technical details
The vulnerability is an authentication bypass in the meshSlaveUpgfw function within the cs_broker component of TOTOLINK T6firmware. The root cause is missing access control validation on firmware upgrade operations—any unauthenticated network client can send a crafted MQTT message to trigger the upgrade routine. No authentication or authorization checks are performed before accepting or processing the firmware flash request. An attacker on the same network (or remotely if MQTT is exposed) can execute arbitrary firmware flashing, leading to service disruption, device compromise, or installation of modified firmware. A patch should implement proper MQTT authentication and role-based access control before initiating upgrade operations.
Affected products
- TOTOLINK T6 4.1.5cu.748_B20211015
Timeline
- 2026-09-01: disclosed