EUVD-2026-69196
GHSA-rmr2-xr58-8gf9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach cs_broker MQTT endpoint on T6
-
DeliveryPublish crafted freeStaClient message
-
ExploitHandler skips access-control check
-
ExecutionTarget wireless client forcibly disconnected
-
ImpactRepeat to sustain Wi-Fi denial
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the TOTOLINK T6's cs_broker MQTT component and the ability to publish a crafted MQTT message invoking the freeStaClient handler; no authentication or user interaction is needed against firmware 4.1.5cu.748_B20211015. Exploitation is limited by broker exposure: if cs_broker listens only on the LAN/loopback (typical for consumer routers), an attacker must first be on the local network, making the practical vector adjacent rather than Internet-facing. Impact is confined to disconnecting wireless clients (an availability/nuisance effect) and does not by itself grant data access or configuration change. |
| Impact | Signals conflict. The input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) is inconsistent with the described behavior: forcibly disconnecting wireless clients is an availability impact, and a temporary one (clients typically re-associate), with no described confidentiality or integrity loss - so C:H/I:H are not supported and A:H is generous for a reconnect-recoverable deauth. A more defensible assessment is C:N/I:N/A:L. Corroborating the lower real-world urgency: EPSS is 0.18% (7th percentile), the CVE is not in CISA KEV, and no public PoC is referenced. Additionally, exploitation presumes reachability of the cs_broker MQTT endpoint; if the broker is bound to the LAN/loopback rather than the WAN, the practical attack vector is adjacent (LAN) rather than truly Internet-wide, which the AV:N rating does not capture. Net: a real but low-priority availability/nuisance issue on a consumer router, not a critical compromise despite the 9.8 label. |
| Exploit ScenarioDerived | An attacker on the same network segment as the router (or on the WAN if cs_broker is externally exposed) connects to the MQTT broker and publishes a crafted message targeting freeStaClient with a victim client identifier. The router disconnects the targeted wireless client(s) without any credentials, and the attacker repeats the message to sustain a denial of Wi-Fi service. No public PoC is currently referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated wireless client disconnection affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015), where the freeStaClient handler in the cs_broker MQTT component performs no authentication or access control on incoming messages. Any attacker able to reach the internal MQTT broker can forcibly deauthenticate/disconnect connected Wi-Fi clients (CWE-284). No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile), and the input's 9.8 CVSS overstates a defect whose real-world effect is a repeatable availability disruption rather than full compromise.
RemediationAI
No vendor-released patch version is identified at time of analysis; consult the TOTOLINK download portal (https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html) for updated T6 firmware and apply any release postdating 4.1.5cu.748_B20211015. As compensating controls: ensure the cs_broker MQTT service is not reachable from the WAN - block/close its listening TCP port at the router firewall and confirm it is not bound to the WAN interface (trade-off: none if the broker is only meant for internal use; if a companion mobile/cloud feature relies on it, that feature may break). Restrict Wi-Fi/LAN access to trusted devices (WPA2/WPA3 with a strong passphrase, disable WPS) to shrink the pool of hosts that can reach the internal broker, and segment IoT/guest devices onto an isolated VLAN/SSID. Monitor for repeated client deauthentication as an indicator of abuse. Retire the device if no fixed firmware is published.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The T6 exposes an internal MQTT message bus via a service the vendor calls cs_broker, which routes control messages to backend handlers on the router. The freeStaClient function is the handler responsible for tearing down (freeing) a station/client association - i.e., disconnecting a wireless client from the access point. Per CWE-284 (Improper Access Control), the handler acts on crafted MQTT messages without verifying the sender's identity or authorization, so a topic/message that would normally originate from an authenticated management path can be injected by an untrusted party. This mirrors a broader family of cs_broker MQTT access-control defects across TOTOLINK T6 handlers (get*/set*/del*/sync functions). The CPE is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not identify the real product, which is confirmed by the description and vendor references to be the TOTOLINK T6.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated crafted MQTT message (AV:N/AC:L/PR:N/UI:N) but effect is only temporary, reconnect-recoverable client disconnection, so C:N/I:N/A:L, not C:H/I:H/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component.
Executive ViewAI
TOTOLINK T6 router firmware (4.1.5cu.748_B20211015 and earlier) contains an unauthenticated control vulnerability in its Wi-Fi client management system that allows attackers with internal network access to forcibly disconnect Wi-Fi clients and disrupt wireless connectivity. No public exploit identified at time of analysis; however, organizations using affected TOTOLINK T6 routers face ongoing availability risk due to lack of vendor-provided patches. This vulnerability requires immediate interim network controls to prevent exploitation.
Network segmentation and access control restrictions on MQTT broker. Restrict administrative MQTT port access (typically 1883/8883) to authorized administrative networks only using firewall rules and network ACLs. Disable MQTT remote access if not required for business operations. Monitor internal network logs for suspicious MQTT traffic patterns. Subscribe to TOTOLINK security advisories for future patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB