Access Control Vulnerability in TOTOLINK T6 by TOTOLINK
CVE-2026-51743

9.1CRITICAL

Key Information:

Vendor

TOTOLINK
Status
TOTOLINK T6
Vendor
CVE Published:
1 September 2026

What is CVE-2026-51743?

An access control flaw in the guest_wifi_sync function of the TOTOLINK T6 router allows unauthenticated attackers to disrupt guest virtual AP interfaces. This is achieved by sending a specially crafted MQTT message to the device's cs_broker component, potentially compromising network security and user data integrity. It is crucial for users to apply security updates and follow best practices for network configuration to mitigate potential risks associated with this vulnerability.

References

https://www.totolink.net/home/menu/detail/menu_listtpl/do...
https://www.totolink.net/
https://github.com/DarkBoulder/CVE-Vendor-Coordination/bl...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.