TOTOLINK T6 CVE-2026-51743

Exploitation requires network reachability to the cs_broker MQTT component and the ability to publish a crafted MQTT message that the guest_wifi_sync function processes; no credentials or user interaction are needed (PR:N/UI:N/AC:L). The primary limiting factor is that on a consumer router the MQTT broker is typically bound to the LAN, so an attacker generally must already be on the local/guest/IoT network (or reach the broker through a WAN misconfiguration) rather than exploit it blindly from the Internet. The device must be the TOTOLINK T6 on firmware 4.1.5cu.748_B20211015, and the guest Wi-Fi feature must be in use for the impact (loss of the guest virtual AP) to matter.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) rates this Critical, but the metric choices conflict with the described impact: disabling a guest AP interface is a loss of service (availability) and a configuration-state change (integrity), not a confidentiality breach - so C:H is not supportable, and A:N is contradictory given the outcome is that guest Wi-Fi stops working. My independent assessment scores it far lower (see assessed vectors). Exploitation is genuinely low-complexity and pre-authentication IF the cs_broker is reachable by the attacker, but on a typical home router that broker is bound to the LAN, so realistic exposure is usually adjacent-network rather than truly Internet-wide, which the AV:N metric may overstate. No EPSS score, KEV entry, or POC was provided, so there is no evidence of active or automated exploitation; the practical impact is limited to knocking out the guest SSID, not compromising the main network or leaking data.

An attacker with access to the router's LAN or IoT segment (for example, a device joined to the guest network itself, or a machine reached through a mis-forwarded port) connects to the cs_broker MQTT service and publishes a crafted message that the guest_wifi_sync handler acts on, disabling the guest virtual AP interfaces and cutting off all guest Wi-Fi clients. Because no authentication is checked, the action succeeds immediately and can be repeated to keep guest service down. No public POC was provided.