CVE-2026-51743 is an incorrect access control vulnerability in the guest_wifi_sync function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can exploit this flaw by sending a crafted MQTT message to the cs_broker component. Successful exploitation allows attackers to disable guest virtual AP interfaces on the affected device. The vulnerability requires no authentication, lowering the barrier for exploitation significantly. TOTOLINK T6 is a consumer/SOHO router, making this a network infrastructure concern. The issue has been reported via GitHub-based CVE vendor coordination repositories. No patch information is explicitly mentioned in the article. The vulnerability was sourced from the NVD (National Vulnerability Database). Related references include TOTOLINK's official website and firmware download pages.
