EUVD-2026-67914
GHSA-g5j5-f582-85mw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain LAN/adjacent network access
-
DeliveryConnect to device MQTT broker
-
ExploitPublish crafted startSlaveReboot message
-
ExecutionMissing authorization check invokes reboot
-
ImpactDevice reboots / repeat for sustained DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the TOTOLINK T6's internal MQTT service and the ability to publish a crafted message to the topic handled by startSlaveReboot; the handler performs no authentication or authorization check. Limiting factors: the MQTT control channel is intended for internal master/slave mesh coordination, so realistic exploitation is from the LAN or an adjacent Wi-Fi segment unless the broker port is exposed to the WAN, which is non-default. Only firmware 4.1.5cu.748_B20211015 is confirmed affected, and impact is limited to forced reboot (no data or code-execution outcome). |
| Impact | The provided CVSS 9.8 (C:H/I:H/A:H) materially overstates impact: forcing a reboot yields an availability effect only, with no confidentiality or integrity compromise, so a more honest score is ~7.5 (A:H, C:N/I:N). Signals otherwise point to modest real-world urgency: EPSS is 0.18% (7th percentile), there is no CISA KEV listing and no public PoC identified. Exploitation being network-reachable and unauthenticated (AV:N/AC:L/PR:N/UI:N) is only meaningful if the MQTT service is actually exposed to the attacker's network position - on a LAN this is trivially reachable, but WAN-side reachability depends on device configuration and is not confirmed. Net: a real but availability-limited flaw, not the critical RCE its headline score suggests. The 'Authentication Bypass' tag is a loose fit - the true defect is missing authorization on an internal control channel, not credential bypass. |
| Exploit ScenarioDerived | An attacker on the router's LAN (e.g., a guest-network or compromised IoT device) connects to the device's MQTT broker and publishes a crafted message invoking startSlaveReboot, causing the router to reboot immediately. Repeating the message keeps the device in a reboot loop, denying connectivity to all users. No credentials or user interaction are required; no public PoC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated denial of service in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets a remote attacker force an arbitrary device reboot by publishing a crafted MQTT message that reaches the internal startSlaveReboot handler, which performs no access-control check. No public exploit is identified at time of analysis, and EPSS is low (0.18%, 7th percentile). The impact is loss of availability rather than the code execution or data theft implied by the assigned CVSS 9.8.
RemediationAI
No vendor-released patched firmware version is identified at time of analysis; the vendor confirmation document (https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/20260424_T6_confirm.pdf) acknowledges the report but does not cite a fixed build. Check the TOTOLINK download portal (https://www.totolink.net/) for firmware later than 4.1.5cu.748_B20211015. As compensating controls: ensure the device's MQTT service is not reachable from the WAN/internet (block inbound to the MQTT broker port, typically 1883, at the perimeter) and segment untrusted clients off the LAN so they cannot publish to the internal coordination topics - trade-off is that mesh slave nodes must remain on a trusted segment to keep node coordination working. Restrict Wi-Fi/LAN access to trusted devices, since any LAN-resident attacker can trigger the reboot. Monitor for unexpected reboot loops as an indicator of abuse.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The T6 is a consumer/SOHO mesh Wi-Fi router that uses MQTT internally for master/slave node coordination. The startSlaveReboot function is one of several MQTT-triggered control operations exposed on the device that lack authentication or authorization (CWE-284, Improper Access Control): any actor able to publish to the relevant MQTT topic can invoke the reboot routine as though it were a trusted master node. This is the same class of missing-authorization flaw seen across the T6 MQTT command surface (e.g., freeStaClient, sendToMasterQosConfig, informSlaveUpdate). The CPE is a placeholder (cpe:2.3:a:n/a:n/a) and does not identify the real product, which is the TOTOLINK T6 firmware image 4.1.5cu.748_B20211015.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated MQTT message reachable over the network (AV:N/AC:L/PR:N/UI:N); forced reboot is availability-only, so C:N/I:N/A:H rather than the input's C:H/I:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message.
Executive ViewAI
TOTOLINK T6 router firmware contains a vulnerability allowing remote attackers to force device reboots without authentication, creating risk of network outages. No public exploitation has been reported at time of analysis, but no vendor patch is currently available. Organizations using these routers should prioritize containing this risk through network isolation and device replacement planning.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to MQTT ports (1883, 8883) via firewall rules or VLAN segmentation; disable MQTT service if operationally unnecessary; implement connection rate-limiting on MQTT interfaces; maintain current configuration backups to enable rapid restoration following reboot events; monitor for suspicious MQTT traffic patterns indicating exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB