CVE-2026-51743 describes an incorrect access control vulnerability in the guest_wifi_sync function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to disable guest virtual AP interfaces by sending a specially crafted MQTT message to the cs_broker component. No authentication is required to exploit this vulnerability, making it accessible to any attacker with network access to the device. The impact includes disruption of guest wireless network services. The vulnerability was reported via GitHub-based CVE vendor coordination repositories. TOTOLINK's official website and firmware download pages are referenced as part of the disclosure. This affects a consumer/SOHO IoT networking device, raising concerns about wide exposure in home and small business environments.
