External risk intelligence

TOTOLINK T6 Router Unauthorized Reboot Configuration

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-51674

The vulnerability exists in a home networking router product. These devices are designed to act as internet edge gateways, and the vulnerable function is reachable via a web-based CGI interface that is commonly exposed to the public internet for remote management or is otherwise directly accessible at the network edge.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability discovered in TOTOLINK T6 routers. An attacker could exploit this issue to remotely reconfigure devices, potentially disrupting network operations. The main concern is confirming if this specific router model is in use and, if so, determining its exposure.

Unauthenticated attackers can force router reboots.
Affects edge network devices, potentially impacting availability.
Confirm usage and exposure; understand potential disruption.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can trigger a forced reboot on a TOTOLINK router by sending a specially crafted request to the device's web interface. This allows the attacker to disrupt the router's operation without needing any prior access or credentials. The vulnerability resides within the `setScheduleCfg` function, which incorrectly handles access control for configuring reboot tasks.

No authentication required for access.
Triggered by a POST request to a CGI script.
Risk of device disruption and availability loss.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows unauthenticated attackers to configure forced reboot tasks on TOTOLINK routers. When supported by the advisory, this could affect the device's availability and potentially allow unauthorized configuration changes.

Router availability could be impacted.
Unauthenticated requests could trigger reboots.
Service disruption and unauthorized changes.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in TOTOLINK routers impacts devices exposed to the network, likely affecting customers managing their own home or small business networks. The first practical step is to identify all instances of the affected product, determine their internet reachability and criticality, and then coordinate with the vendor for a permanent fix.

Identify affected device owners.
Verify external reachability first.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK T6?

The TOTOLINK T6 is a router used to manage home and small business network traffic. As a networking device, it acts as the gateway between a local network and the internet, routing data and providing connectivity for connected computers, phones, and smart home devices.

What does CWE-284 mean for CVE-2026-51674?

CWE-284 refers to improper access control. In the context of this CVE, it means the router's software fails to verify the identity of the user attempting to change system settings. Because of this oversight in the setScheduleCfg function, the device does not require valid credentials to process instructions, allowing unauthorized parties to modify its internal configuration.

How is the reboot task triggered?

The vulnerability is triggered when an attacker sends a specific, crafted POST request to the router's web-based CGI interface. Simply accessing the management page is not enough to cause the issue; the attacker must direct this specific data packet to the vulnerable script to force a reboot. Requests that do not conform to this structure or do not target the setScheduleCfg function will not activate this specific reboot command.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies that this router is a network edge device, meaning it is often connected directly to the internet. If your device's web management interface is reachable from outside your local network, it is at higher risk because remote attackers can send the malicious request directly. Devices that are only accessible from within your local network or have remote management disabled face a lower likelihood of direct interaction from external threats.

What should I do if I use this router?

Start by locating all TOTOLINK T6 units on your network and verifying if their management interfaces are exposed to the internet. If you find exposed devices, consider restricting access to the management panel to local connections only. Monitor the vendor's official support channels for firmware updates that address this access control flaw, and prepare to apply them as soon as they become available to secure your gateway.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.