Description

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the cs_broker component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-01T14:17:37.143Z",
  "pubdate": "2026-09-01T14:17:37.143Z",
  "executiveSummary": "This vulnerability involves an incorrect access control flaw in the setDevReboot function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015).\nThe vulnerability allows an unauthenticated, network-adjacent attacker to trigger an unauthorized device reboot.\nThe flaw stems from the improper validation of MQTT messages processed by the cs_broker component, which is responsible for inter-device communication within the mesh network.\nAn attacker can exploit this by crafting and injecting specific MQTT messages, causing the device to initiate a reboot sequence.\nFor mesh-enabled master nodes, the exploitation can propagate to connected mesh slaves, allowing an attacker to cause a coordinated denial-of-service across the entire mesh infrastructure.\nThe risk implication is high, as it facilitates unauthorized service disruption without requiring valid administrative credentials, leveraging the trust relationship inherent in the internal MQTT messaging protocol.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the setDevReboot function within the cs_broker component of the TOTOLINK T6 firmware. The system fails to implement sufficient access control checks for MQTT messages processed by this broker.\nIn the context of the T6 architecture, the cs_broker facilitates management communication between the master node and its mesh slaves. The setDevReboot function serves as an internal handler intended for system administration and mesh synchronization. However, the lack of authentication or message origin validation allows any entity capable of sending messages to the broker to invoke this sensitive function.\nThe exploitation flow initiates when an attacker transmits a crafted MQTT message destined for the cs_broker service. Because the application logic does not verify if the message sender possesses administrative privileges or a valid session, the broker interprets the payload as a legitimate command.\nUpon receiving the malicious payload, the setDevReboot function proceeds to execute the system-level command required to initiate a hardware or software reset. If the targeted device is configured as a mesh master, the logic further processes the request to propagate the command to connected mesh slaves. This functionality, while intended for legitimate centralized management, enables the attacker to force an entire mesh network cluster into a reboot state simultaneously, resulting in a widespread denial-of-service condition.\nThe attack vector requires network-level access to the MQTT broker, which is typically exposed on the local area network. Since the target environment does not enforce authentication at the message broker level, the barrier to entry is minimal for any unauthorized device already connected to the internal network. The vulnerability persists across the specified version (4.1.5cu.748_B20211015) and highlights a critical failure in the secure design of internal inter-process communication protocols within the firmware."
}