Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

TOTOLINK T6 router can drop Wi‑Fi users remotely

CVE-2026-51763 · published 2 months ago
Summary

The TOTOLINK T6 router version 4.1.5cu.748 allows anyone on the network to send a specially formed MQTT message that forces the router to disconnect wireless clients. This could interrupt your employees' or customers' Wi‑Fi access without needing a password. Update the router firmware or apply the vendor’s patch to restore proper access controls.

Original advisory text
Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT messa...
Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published1 Sep 2026
Updated4 Nov 2026
First seen1 Sep 2026
Sources
CVE-2026-51763 · NVD
CVE-2026-51763 · MITRE
Track software like this
Free during beta