CVE-2026-51766 Overview
CVE-2026-51766 is an incorrect access control vulnerability in the setDevReboot function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can send a crafted Message Queuing Telemetry Transport (MQTT) message to the cs_broker component to trigger a device reboot. On a master node in a mesh deployment, the same message fans out reboot commands to connected mesh slaves. The flaw maps to CWE-284: Improper Access Control and enables network-based denial of service against affected routers and their mesh peers.
Critical Impact
Unauthenticated attackers can remotely reboot TOTOLINK T6 devices and cascade reboots across mesh slave nodes, causing sustained network outages.
Affected Products
- TOTOLINK T6 router firmware 4.1.5cu.748_B20211015
- TOTOLINK T6 devices operating as mesh master nodes
- TOTOLINK T6 devices operating as mesh slaves reachable from an affected master
Discovery Timeline
- 2026-09-01 - CVE-2026-51766 published to the National Vulnerability Database (NVD)
- 2026-09-01 - Last updated in the NVD database
Technical Details for CVE-2026-51766
Vulnerability Analysis
The TOTOLINK T6 exposes an MQTT broker component named cs_broker used for internal mesh coordination. The setDevReboot function processes reboot requests received through this broker without validating the identity or authorization of the requester. An attacker who can reach the broker over the network can publish a crafted MQTT message that triggers the reboot handler.
When the affected device operates as a mesh master, setDevReboot propagates the reboot instruction to every registered mesh slave. A single unauthenticated message therefore reboots the entire mesh, not just the initial target. This produces a repeatable network-wide denial of service with no user interaction required.
The defect impacts availability only. The vulnerability does not grant code execution, credential disclosure, or configuration modification.
Root Cause
The root cause is missing authentication and authorization checks on the MQTT message path that reaches setDevReboot. The cs_broker component treats messages from any connected client as trusted mesh control traffic. This violates the least-privilege principle expected for management operations such as device reboot.
Attack Vector
Exploitation requires network reachability to the cs_broker MQTT service on the TOTOLINK T6. The attacker publishes an MQTT message matching the topic and payload structure consumed by setDevReboot. No credentials, tokens, or session state are required. On master devices, the broker relays the reboot command to slave nodes over the mesh backhaul, amplifying the impact.
Refer to the coordination advisories at DarkBoulder CVE Vendor Coordination and ShengWu00 CVE Vendor Coordination for technical details on the message format.
Detection Methods for CVE-2026-51766
Indicators of Compromise
- Unexpected reboot events across one or more TOTOLINK T6 devices in a short time window
- Simultaneous reboots of mesh slave nodes following a reboot of the master node
- Inbound MQTT connections to the cs_broker service from untrusted source addresses
- MQTT PUBLISH messages targeting reboot-related topics from clients that are not registered mesh peers
Detection Strategies
- Monitor router syslog and uptime counters for clusters of reboot events on TOTOLINK T6 devices
- Inspect network flow records for MQTT traffic (TCP 1883 or 8883) reaching the router from outside the trusted management segment
- Correlate mesh slave reboots with master node MQTT activity to identify fan-out patterns
Monitoring Recommendations
- Alert when router uptime resets outside of scheduled maintenance windows
- Log all MQTT connections and publishes on management VLANs and forward them to a central data lake for retention
- Baseline expected MQTT client identifiers on the mesh and alert on unknown clients
How to Mitigate CVE-2026-51766
Immediate Actions Required
- Restrict network access to the cs_broker MQTT service using firewall rules that permit only trusted mesh peers
- Isolate TOTOLINK T6 devices on a dedicated management VLAN that is not routable from user or guest networks
- Disable remote management interfaces on the WAN side of the device
- Monitor for unscheduled reboots and treat repeated reboots as a security event
Patch Information
No vendor patch is referenced in the NVD record at the time of publication. Check the TOTOLINK official website and the TOTOLINK firmware download page for updated firmware for the T6 platform. Apply firmware updates as soon as the vendor publishes a fix that addresses the setDevReboot access control defect.
Workarounds
- Block inbound MQTT (1883/8883) at the network perimeter and between segments that do not require mesh coordination
- Place mesh backhaul traffic on a segregated SSID or wired VLAN with access control lists limiting broker reachability
- Where mesh functionality is not required, operate the T6 as a standalone access point to reduce broker exposure
- Replace end-of-support or unpatched T6 units with devices that provide authenticated management channels
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.