Incorrect Access Control in TOTOLINK T6 Firmware via MQTT Message

Executive Summary

This vulnerability is an incorrect access control issue in the recvIndirectMeshInfo function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to manipulate mesh neighbor records by sending a specially crafted MQTT message to the cs_broker component.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unauthorized MQTT messages targeting the cs_broker component. Check network traffic for unexpected MQTT packets to port 1883 or 8883. Inspect logs for recvIndirectMeshInfo function calls or mesh neighbor record modifications.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to insert or replace mesh neighbor records, potentially disrupting network routing or enabling further attacks on the device or connected systems. This could lead to unauthorized access or control of the network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to manipulate mesh neighbor records via crafted MQTT messages, which could lead to unauthorized access or data exposure. Such access control issues may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by enabling unauthorized data access or breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update TOTOLINK T6 firmware to the latest version. Block unauthorized MQTT traffic at the firewall level. Disable unnecessary MQTT services if not required. Monitor network traffic for suspicious activity related to mesh neighbor records.

Useful 0 Not Useful 0