Incorrect Access Control in TOTOLINK T6 Firmware

Executive Summary

This vulnerability is an incorrect access control issue in the setElinkQosConfig function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. It allows unauthenticated attackers to modify privileged Quality of Service (QoS) policies on the master device by sending a specially crafted MQTT message to the cs_broker component.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring MQTT traffic for unauthorized messages targeting the cs_broker component. Check for unexpected QoS policy modifications on TOTOLINK T6 devices. Use network sniffing tools like tcpdump or Wireshark to capture MQTT traffic on port 1883 or 8883.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to change network traffic priorities, potentially disrupting critical services or allowing unauthorized network access. This could lead to degraded network performance, unauthorized data access, or denial of service on the affected device.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to modify privileged QoS policy via crafted MQTT messages, which could disrupt network traffic management. Such unauthorized access may violate data integrity and confidentiality requirements in GDPR and HIPAA, potentially leading to non-compliance if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately isolate affected TOTOLINK T6 devices from untrusted networks. Disable MQTT access to the cs_broker component if possible. Update firmware to the latest version if a patch exists. Monitor device logs for unauthorized QoS policy changes.

Useful 0 Not Useful 0