Unauthorized Device Reboot Vulnerability in TOTOLINK Products
CVE-2026-51766

7.5HIGH

Key Information:

Vendor

TOTOLINK
Status
TOTOLINK T6
Vendor
CVE Published:
1 September 2026

What is CVE-2026-51766?

A vulnerability in the setDevReboot function of the TOTOLINK T6 product series allows unauthorized attackers to remotely reboot the device. By exploiting this access control flaw, an attacker can send specially crafted MQTT messages to the cs_broker component, enabling them to issue reboot commands not only to the local device but also to any associated mesh slave devices, disrupting network operations and compromising network integrity.

References

https://www.totolink.net/home/menu/detail/menu_listtpl/do...
https://www.totolink.net/
https://github.com/DarkBoulder/CVE-Vendor-Coordination/bl...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.