Incorrect Access Control in TOTOLINK T6 Firmware via MQTT Message

Executive Summary

This vulnerability is an incorrect access control issue in the TOTOLINK T6 router firmware version 4.1.5cu.748_B20211015. The flaw exists in the sendStaticInfoToMaster function, which improperly handles authentication. An unauthenticated attacker can exploit this by sending a specially crafted MQTT message to the cs_broker component to update stored slave inventory records without proper authorization.

Useful 0 Not Useful 0

Impact Analysis

If you use a TOTOLINK T6 router with the vulnerable firmware, an attacker could remotely modify inventory records on your device. This may allow unauthorized changes to network configurations, potentially leading to network disruptions, unauthorized access to connected devices, or further exploitation of your network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to modify stored slave inventory records via crafted MQTT messages, which could lead to unauthorized data manipulation. Such access control flaws may violate compliance requirements under GDPR (data integrity) and HIPAA (security controls) by enabling unauthorized changes to sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update TOTOLINK T6 firmware to the latest version to fix the incorrect access control in sendStaticInfoToMaster. Disable MQTT message handling for the cs_broker component if updates are not available. Restrict network access to the device to prevent unauthenticated MQTT message injection.

Useful 0 Not Useful 0