CVE-2026-51611 Overview
CVE-2026-51611 is an incorrect access control vulnerability in the startSlaveReboot function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can force the device to reboot by sending a crafted Message Queuing Telemetry Transport (MQTT) message. The flaw is categorized under [CWE-284] Improper Access Control and requires no authentication, user interaction, or elevated privileges. Successful exploitation disrupts network connectivity for all clients depending on the router, enabling a persistent denial-of-service condition against affected devices.
Critical Impact
Remote unauthenticated attackers can trigger arbitrary device reboots over the network, causing sustained denial of service for TOTOLINK T6 routers.
Affected Products
- TOTOLINK T6 router
- Firmware version 4.1.5cu.748_B20211015
- Devices exposing the MQTT service to reachable networks
Discovery Timeline
- 2026-08-28 - CVE-2026-51611 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-51611
Vulnerability Analysis
The TOTOLINK T6 firmware exposes an MQTT-based control interface used to manage device functions, including reboots. The startSlaveReboot function processes incoming MQTT messages but fails to verify the sender's authentication state or authorization level. Any client capable of publishing to the appropriate MQTT topic can invoke the reboot handler.
The vulnerability sits at the intersection of network exposure and missing access control checks. Because MQTT operates over TCP and the firmware does not gate the reboot command behind credentials or session validation, an attacker only needs network reachability to the broker port to trigger the function. Repeated invocation keeps the device in a reboot loop, effectively denying service to all downstream clients.
Root Cause
The root cause is missing authorization enforcement in the startSlaveReboot handler. The function trusts incoming MQTT messages without validating whether the publisher holds an authenticated session or administrative role. This design flaw maps directly to [CWE-284] Improper Access Control.
Attack Vector
Exploitation is performed remotely across the network. An attacker connects to the MQTT broker exposed by the T6 router and publishes a crafted message targeting the topic consumed by startSlaveReboot. No credentials, prior compromise, or user interaction is required. Refer to the GitHub Vulnerability Report and the Vendor Confirmation Document for the full technical write-up. No verified proof-of-concept code has been published at this time.
Detection Methods for CVE-2026-51611
Indicators of Compromise
- Unexpected reboot events in TOTOLINK T6 system logs without corresponding administrative actions.
- Inbound MQTT connections to the router from unrecognized external or lateral source addresses.
- Repeated MQTT PUBLISH packets targeting device control topics associated with reboot handlers.
Detection Strategies
- Monitor MQTT broker traffic (typically TCP port 1883 or 8883) originating from or destined to embedded devices, and alert on publishes from unauthenticated clients.
- Correlate router uptime resets with concurrent network events to identify externally induced reboots.
- Deploy network detection rules that flag MQTT PUBLISH payloads referencing reboot or slave-control topics on router management interfaces.
Monitoring Recommendations
- Centralize router syslog output and alert on frequent system restart or watchdog-triggered reboot messages.
- Track availability metrics for the T6 device and correlate outages with packet captures at the network perimeter.
- Review firewall logs for unsolicited traffic to MQTT ports on internal router management IP addresses.
How to Mitigate CVE-2026-51611
Immediate Actions Required
- Block inbound MQTT traffic (TCP 1883/8883) to TOTOLINK T6 devices at the network perimeter and restrict access to trusted management segments.
- Inventory all TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 and isolate them from untrusted networks.
- Monitor vendor channels for a corrective firmware release and apply it as soon as it becomes available.
Patch Information
At the time of publication, no vendor patch has been referenced in the NVD entry. Consult the TOTOLINK Document Download Page and the TOTOLINK Official Website for firmware updates. Coordination status is tracked in the Vendor Coordination README.
Workarounds
- Disable the MQTT service on affected devices if the deployment does not require it.
- Place T6 routers behind a firewall that denies inbound connections to management protocols from untrusted networks.
- Segment IoT and consumer-grade routers onto a dedicated VLAN with strict egress and ingress filtering to limit exposure to crafted MQTT messages.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.