The vulnerability arises from improper access control in the guest_wifi_sync function of the TOTOLINK T6 firmware 4.1.5cu.748_B20211015, enabling an attacker to craft a specific MQTT message that disables the guest virtual access‑point interfaces. This action removes guest Wi‑Fi connectivity, effectively denying service to any user who depends on the guest network and thereby compromising system availability.

The flaw is present only in TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015. No other vendors or product variations are documented in the advisory.

The attack vector is remote and requires access to the MQTT broker; authentication is not required, making the exploit trivial once network reach is possible. The CVSS score of 9.1 signals critical severity. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog, yet the absence of a known patch and the ease of exploitation suggest a high likelihood of attack against exposed systems.