EUVD-2026-67914
GHSA-g5j5-f582-85mw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated MQTT message reachable over the network (AV:N/AC:L/PR:N/UI:N); forced reboot is availability-only, so C:N/I:N/A:H rather than the input's C:H/I:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message.
AnalysisAI
Unauthenticated denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker force an arbitrary device reboot by publishing a crafted MQTT message that reaches the internal startSlaveReboot handler, which performs no access-control check. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to the TOTOLINK T6's internal MQTT service and the ability to publish a crafted message to the topic handled by startSlaveReboot; the handler performs no authentication or authorization check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 9.8 (C:H/I:H/A:H) materially overstates impact: forcing a reboot yields an availability effect only, with no confidentiality or integrity compromise, so a more honest score is ~7.5 (A:H, C:N/I:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched firmware version is identified at time of analysis; the vendor confirmation document (https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/20260424_T6_confirm.pdf) acknowledges the report but does not cite a fixed build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all TOTOLINK T6 routers in your network, assess their role in critical network paths, and locate current firmware versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today