An unauthenticated attacker can craft an MQTT message to the TOTOLINK T6 device and trigger the startSlaveReboot function, because the function has incorrect access control. The call forces the router to reboot, causing a sudden loss of connectivity and service without exposing data or executing arbitrary code.

Firmware version 4.1.5cu.748_B20211015 of the TOTOLINK T6 router is affected. No other vendors or product versions are listed in the CNA information.

The flaw can be exploited over the network by sending a crafted MQTT packet; no authentication is required. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, yet the ability to cause an uncontrolled reboot can have significant operational impacts. The attack vector is via network access to the MQTT service, potentially from remote or local sources depending on network exposure.