CVE-2026-51743: n/a

This vulnerability in TOTOLINK T6 4.1.5cu.748_B20211015 arises from improper access control in the guest_wifi_sync function. An unauthenticated attacker can exploit this flaw by sending a specially crafted MQTT message to the cs_broker component, which results in disabling guest virtual AP interfaces. The CVSS v3.1 base score is 9.1, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows an unauthenticated attacker to disable guest virtual AP interfaces, potentially disrupting guest network access and compromising network confidentiality and integrity. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a patch is available, restricting access to MQTT broker components or network segmentation may reduce exposure, but these are not confirmed vendor recommendations.