Incorrect Access Control in TOTOLINK T6 Firmware

Executive Summary

This vulnerability is an incorrect access control issue in the delSlaveDevice function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to remove a slave device from local mesh management data and reboot the system by sending a specially crafted MQTT message to the cs_broker component.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unauthorized MQTT messages targeting the cs_broker component. Check network traffic for MQTT packets with malformed payloads attempting to invoke the delSlaveDevice function. Inspect system logs for unexpected device removals or reboots.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to disrupt network operations by rebooting the device or removing critical slave devices from the mesh network, potentially causing downtime or loss of network connectivity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to reboot the system and manipulate mesh management data, which could lead to unauthorized access or data loss. Such disruptions may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by compromising system integrity and availability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the TOTOLINK T6 firmware to the latest version. Disable MQTT access to the cs_broker component if not required. Restrict network access to the device's management interface and monitor for suspicious MQTT activity.

Useful 0 Not Useful 0