Incorrect Access Control in TOTOLINK T6 Firmware via MQTT Message

Executive Summary

This vulnerability is an incorrect access control issue in the updateSlaveIpList function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to manipulate the slave IP inventory state by sending a specially crafted MQTT message to the cs_broker component.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unauthorized MQTT messages targeting the cs_broker component. Check network traffic for unexpected MQTT packets to port 1883 or 8883. Inspect logs for the updateSlaveIpList function being called without authentication.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to alter network configurations, potentially disrupting operations or gaining unauthorized access to connected devices. This may lead to network instability, unauthorized control of devices, or further exploitation of connected systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to manipulate system state via crafted MQTT messages, which could lead to unauthorized access or data exposure. Such access control flaws may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by enabling unauthorized data access or modification.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update TOTOLINK T6 to the latest firmware version. Block external MQTT traffic to the device at the network perimeter. Disable the cs_broker component if not required. Monitor for signs of exploitation such as unauthorized IP list modifications.

Useful 0 Not Useful 0