EUVD-2026-69210
GHSA-236r-x7h9-mjjg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router LAN/broker network
-
DeliveryConnect to cs_broker MQTT service
-
ExploitPublish crafted guest_wifi_sync message
-
ExecutionBypass missing access control
-
PersistDisable guest virtual AP interfaces
-
ImpactGuest Wi-Fi service denied
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the cs_broker MQTT component and the ability to publish a crafted MQTT message that the guest_wifi_sync function processes; no credentials or user interaction are needed (PR:N/UI:N/AC:L). The primary limiting factor is that on a consumer router the MQTT broker is typically bound to the LAN, so an attacker generally must already be on the local/guest/IoT network (or reach the broker through a WAN misconfiguration) rather than exploit it blindly from the Internet. The device must be the TOTOLINK T6 on firmware 4.1.5cu.748_B20211015, and the guest Wi-Fi feature must be in use for the impact (loss of the guest virtual AP) to matter. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) rates this Critical, but the metric choices conflict with the described impact: disabling a guest AP interface is a loss of service (availability) and a configuration-state change (integrity), not a confidentiality breach - so C:H is not supportable, and A:N is contradictory given the outcome is that guest Wi-Fi stops working. My independent assessment scores it far lower (see assessed vectors). Exploitation is genuinely low-complexity and pre-authentication IF the cs_broker is reachable by the attacker, but on a typical home router that broker is bound to the LAN, so realistic exposure is usually adjacent-network rather than truly Internet-wide, which the AV:N metric may overstate. No EPSS score, KEV entry, or POC was provided, so there is no evidence of active or automated exploitation; the practical impact is limited to knocking out the guest SSID, not compromising the main network or leaking data. |
| Exploit ScenarioDerived | An attacker with access to the router's LAN or IoT segment (for example, a device joined to the guest network itself, or a machine reached through a mis-forwarded port) connects to the cs_broker MQTT service and publishes a crafted message that the guest_wifi_sync handler acts on, disabling the guest virtual AP interfaces and cutting off all guest Wi-Fi clients. Because no authentication is checked, the action succeeds immediately and can be repeated to keep guest service down. No public POC was provided. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated denial of the guest Wi-Fi service on the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) is possible because the guest_wifi_sync function performs no access control on messages arriving at the internal cs_broker MQTT component. Any attacker able to reach the broker can publish a crafted MQTT message to tear down the guest virtual AP interfaces, disrupting guest connectivity without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
RemediationAI
No vendor-released patch version was identified at time of analysis; monitor TOTOLINK (https://www.totolink.net/) and the coordination READMEs (DarkBoulder/ShengWu00 CVE-Vendor-Coordination) for a firmware update superseding 4.1.5cu.748_B20211015 and apply it once published. As compensating controls, ensure the device's management/IoT surface - including the MQTT broker - is not exposed to the WAN by disabling any remote-management option and confirming no port-forward reaches the broker (side effect: none for typical users). On the LAN, restrict access to the broker to trusted hosts via firewall/ACL where the firmware permits (side effect: may break legitimate app-based control features). If the guest network is not needed, disabling the guest Wi-Fi feature entirely removes the affected interface as a target (side effect: loss of guest SSID functionality). Segment untrusted client devices off the router so an attacker cannot reach the internal broker from a guest or IoT VLAN.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The T6 is a consumer/SOHO dual-band Wi-Fi router. Internally it uses an MQTT-based message bus (the cs_broker component) to coordinate state between subsystems, and the guest_wifi_sync handler acts on messages to synchronize the guest virtual access-point configuration. The root cause is CWE-284 (Improper Access Control): the handler processes MQTT messages that instruct it to disable guest virtual AP interfaces without verifying that the publisher is authenticated or authorized. Because the broker trusts any client that can connect, control-plane messages that should be device-internal can be injected by an outside party.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated low-complexity MQTT injection, but impact is only disabling the guest AP - a config-state change (I:L) and loss of the guest service (A:L), with no confidentiality impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the cs_broker component.
Executive ViewAI
The TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) contains an unauthenticated vulnerability in its guest WiFi management service that allows network-adjacent attackers to disable guest network access via MQTT messaging. Organizations depending on guest connectivity face business disruption and customer experience impact, with no vendor patch currently available.
Restrict network access to internal MQTT brokers via firewall rules and network segmentation; implement monitoring and alerting on MQTT publish operations to detect exploitation attempts; disable the guest WiFi feature if not operationally required; disable MQTT functionality if it serves no business purpose; limit management access to the router to authorized systems only; establish regular audit of network access to internal broker systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB