An unauthenticated attacker can craft an MQTT message to the TOTOLINK T6 device and trigger the startSlaveReboot function, because the function has incorrect access control. The call forces the router to reboot, causing a sudden loss of connectivity and service without exposing data or executing arbitrary code.

Firmware version 4.1.5cu.748_B20211015 of the TOTOLINK T6 router is affected. No other vendors or product versions are listed in the CNA information.

The flaw can be exploited over the network by sending a crafted MQTT packet; no authentication is required. The CVSS score of 9.8 indicates critical severity. The EPSS score of less than 1% and the fact that the vulnerability is not listed in the CISA KEV catalog suggest that exploitation probability is low, but the ability to cause an uncontrolled reboot can still have significant operational impacts. The attack vector is via network access to the MQTT service, potentially from remote or local sources depending on network exposure.