Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force an… (CVE-2026-51610)

CVE-2026-51610 is an access control vulnerability in the TOTOLINK T6 router firmware 4.1.5cu.748_B20211015. The RebootSystem function lacks proper authentication checks, allowing unauthenticated remote attackers to trigger an immediate reboot by sending a crafted POST request to the /cgi-bin/cstecgi.cgi CGI endpoint. This results in denial of service due to device unavailability during reboot. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 4.3, indicating medium severity with no confidentiality or integrity impact, only availability impact.

The vulnerability allows unauthenticated attackers to cause a denial of service by forcing the device to reboot unexpectedly. There is no impact on confidentiality or integrity of the device or network traffic. The device becomes temporarily unavailable during the reboot process.

No official patch or remediation information is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates and apply any future patches promptly. Until a fix is released, restricting network access to the device's management interface and disabling remote management where possible may reduce exposure.