TOTOLINK T6 CVE-2026-51766

Exploitation requires network reachability to the TOTOLINK T6's MQTT cs_broker component - no credentials, special configuration, or user interaction are needed (CVSS PR:N, AC:L, UI:N). The device must be running firmware version 4.1.5cu.748_B20211015; other firmware versions are unconfirmed as affected or unaffected. The mesh fan-out amplification applies only when the targeted device is configured as a mesh master in a multi-device TOTOLINK T6 deployment; single-device installations experience only a local reboot. In typical home or SMB deployments the cs_broker MQTT port is LAN-accessible, limiting exploitation to local network presence or LAN-adjacent attackers; publicly exposed MQTT ports would expand the attack surface to remote internet-based attackers. No authentication bypass technique is required - the flaw is the complete absence of access control on the setDevReboot function.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately reflects the threat profile: network-accessible, unauthenticated, zero-complexity exploitation producing high availability impact. The Unchanged scope designation does not fully convey the mesh fan-out behavior - a single unauthenticated request against a master node can simultaneously reboot all slave nodes, effectively multiplying the denial-of-service footprint beyond what S:U implies; CVSS 4.0 subsequent-system metrics (SA:H) better capture this amplification. EPSS data is absent from available sources so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV, and the GitHub coordination repositories suggest researcher-driven coordinated disclosure rather than active threat-actor exploitation. The impact is purely availability - no confidentiality or integrity compromise occurs - which limits urgency relative to RCE-class findings at equivalent CVSS scores. Organizations deploying TOTOLINK T6 in mesh configurations face materially higher effective risk than single-device deployments due to the fan-out multiplier; network segmentation of the MQTT broker is the most actionable short-term control.

An unauthenticated attacker on a network segment with access to the TOTOLINK T6's MQTT cs_broker port publishes a crafted MQTT message targeting the setDevReboot handler; the device processes the command without any credential check and immediately reboots. If the device is a mesh master, it relays the reboot command to all registered slave nodes before restarting, taking down the entire mesh network simultaneously with a single request. No exploit code has been publicly confirmed, but the attack requires only standard MQTT client tooling and knowledge of the target broker address.