CVE-2026-51743

CVE-2026-51743 is an incorrect access control flaw (CWE-284) in the guest_wifi_sync function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015. An unauthenticated attacker can trigger it by sending a crafted MQTT message to the device's cs_broker component, bypassing the access controls that should restrict this function. A successful attack allows the attacker to disable guest virtual AP interfaces, disrupting guest Wi-Fi service on affected routers (the assigned CVSS 3.1 score of 9.1 rates it critical, with network attack vector, no privileges or user interaction required, and high confidentiality and integrity impacts). Users running the affected TOTOLINK T6 firmware are at risk, particularly devices whose MQTT/cs_broker interface is reachable from untrusted networks. There is currently no known exploitation, no public proof-of-concept, and the vulnerability is not listed in CISA's KEV, with a modest EPSS probability of 0.4% over the next 30 days.

What to do: Check whether any TOTOLINK T6 devices on your networks run firmware 4.1.5cu.748_B20211015 and monitor TOTOLINK for a corrected firmware release, as no fixed version is specified in the available data. In the meantime, restrict unauthenticated access to the MQTT broker (cs_broker) port on these devices, e.g. by firewalling the WAN side or limiting MQTT access to trusted management networks. If guest Wi-Fi is not needed, consider disabling the guest virtual AP feature to reduce impact.