EUVD-2026-69377
GHSA-p69c-22hx-vq62
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach cs_broker MQTT service on T6
-
DeliveryCraft MQTT message for recvClearPairCfg
-
ExploitPublish without authentication
-
ExecutionHandler clears pairing state
-
ImpactDevice reboots (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the TOTOLINK T6's cs_broker MQTT component and the ability to publish a crafted MQTT message to the recvClearPairCfg handler; no credentials, user interaction, or non-default configuration is described (PR:N/UI:N/AC:L). The key limiting factor is broker exposure: if cs_broker is bound only to the LAN or mesh segment, remote internet exploitation is not possible and the attacker must have LAN/adjacent access. Impact is confined to a specific firmware build (4.1.5cu.748_B20211015) and to the device targeted, and the outcome is disruption (reboot + pairing reset), not code execution or data theft. |
| Impact | The vendor/NVD CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world impact: the described behavior is resetting pairing state and rebooting the device, which is fundamentally an availability event with a limited integrity component - there is no described data disclosure, so C:H is not supported by the description. SSVC provides a more balanced view: Exploitation 'none' (no known active exploitation or public PoC), Automatable 'yes' (a single unauthenticated MQTT message, scriptable), Technical Impact 'total' (attacker fully controls the targeted action). EPSS is low (0.18%), consistent with no public exploit code. The practical priority hinges on network exposure: if cs_broker/MQTT is only reachable on the LAN, this is a LAN-adjacent nuisance DoS; if the broker is reachable from the WAN, it becomes a trivially automatable remote reboot loop. AV:N in the vector implies network reachability - verify actual broker exposure on the specific deployment, as many SOHO devices bind such brokers to the LAN only. |
| Exploit ScenarioDerived | An attacker on the same network as the router (or across the internet if the MQTT broker is exposed) publishes a single crafted MQTT message to the cs_broker topic handled by recvClearPairCfg. Because no authentication is enforced, the device immediately clears its pairing state and reboots; the attacker can script this into a repeated loop to keep the device offline. No public PoC is currently identified, but the action is trivially automatable per SSVC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Unauthenticated device reboot and pairing-state reset affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) via its recvClearPairCfg handler, which processes MQTT messages to the cs_broker component without verifying the sender's authorization. A remote attacker who can reach the MQTT broker can send a crafted message to wipe the device's pairing state and force a reboot, disrupting connectivity. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with SSVC exploitation status of 'none'.
RemediationAI
No vendor-released patched firmware version is identified in the provided data at time of analysis; monitor the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) and the vendor-coordination trackers for a fixed build superseding 4.1.5cu.748_B20211015. As compensating controls, restrict reachability of the cs_broker MQTT service to trusted hosts - block the MQTT broker port at the network boundary and ensure it is not exposed to the WAN/internet (trade-off: none for internet-facing exposure, which should never be present; verify remote-management features are disabled). Segment the router's management/mesh plane onto an isolated VLAN so untrusted LAN clients (IoT/guest devices) cannot reach the broker (trade-off: mesh peers must remain on the trusted segment to keep pairing functional). If the device is not used in mesh mode, disabling mesh/pairing functionality reduces the attack surface. Because the impact is reboot/reset rather than persistent compromise, monitoring for unexpected reboots and pairing resets provides useful detection while a patch is pending.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TOTOLINK T6 is a consumer/SOHO mesh Wi-Fi router. It uses an internal MQTT publish/subscribe fabric (the cs_broker component) to coordinate mesh/pairing operations between nodes; recvClearPairCfg is the message handler that clears pairing configuration. The root cause is CWE-284 (Improper Access Control): the handler trusts any actor able to publish to the broker topic and performs no authentication or authorization check before executing a privileged state-clearing and reboot action. This is the same architectural weakness class seen across the T6 MQTT command surface (e.g. startSlaveReboot in CVE-2026-51611 and freeStaClient in CVE-2026-51763), where MQTT command handlers act on unauthenticated input.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network MQTT message forces reboot (A:H) and clears pairing state (I:L); no data disclosure so C:N, contradicting the vendor's C:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the cs_broker component.
Executive ViewAI
TOTOLINK T6 routers (firmware 4.1.5cu.748_B20211015 and potentially other versions) are vulnerable to unauthenticated remote reboot and pairing-state reset via MQTT protocol, creating a denial-of-service risk for any organization using these devices as network infrastructure. An attacker with network access to the MQTT broker can force device restarts and disable pairing functionality without authentication, disrupting network connectivity and operations. No vendor patch is currently available, requiring immediate interim protective measures.
Restrict MQTT broker access using firewall rules and network segmentation; disable MQTT functionality on affected routers if not operationally required; implement strong authentication and access controls on MQTT brokers; monitor and log MQTT traffic for unauthorized commands; deploy routers behind additional firewall appliances to limit direct exposure; maintain inventory of affected units for rapid remediation upon patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB