CVE-2026-51611: n/a

The vulnerability CVE-2026-51611 affects TOTOLINK T6 version 4.1.5cu.748_B20211015. It arises from improper access control in the startSlaveReboot function, which can be triggered without authentication via a specially crafted MQTT message. This flaw allows an attacker to arbitrarily reboot the device, potentially causing denial of service. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported.

An unauthenticated attacker can remotely force a reboot of the affected TOTOLINK T6 device by sending a crafted MQTT message. This can lead to denial of service, disrupting device availability and potentially impacting network operations relying on the device. The vulnerability affects confidentiality and integrity due to the ability to manipulate device behavior without authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting MQTT message access to trusted sources and monitoring for unusual MQTT traffic targeting the device. No official fix or temporary workaround has been documented at this time.