An incorrect access control check in TOTOLINK devices running firmware version T6 4.1.5cu.748_B20211015 allows any entity that can reach the MQTT broker to send a specifically crafted updatePriStaList command. The function, when invoked, refreshes the internal list of primary stations without verifying that the sender is authenticated. Because this function performs an operation that alters device configuration, an attacker can force the Wi‑Fi router to reload its station list, potentially disrupting normal connectivity or creating a loop in the firmware. The affected code falls under CWE‑284, an improper authorization flaw.

The vulnerability affects devices manufactured by TOTOLINK, specifically the T6 series with firmware T6 4.1.5cu.748_B20211015. No other versions or variants are listed as affected. The description does not provide a broader version range, so administrators should check the exact firmware string against the one below to determine if the device is impacted.

The CVSS base score of 5.3 classifies this weakness as moderate severity. The EPSS score is currently unavailable, but the lack of a public exploit and absence from the CISA KEV catalog suggest that exploitation risk is moderate. Exploitation requires the ability to send MQTT messages to the cs_broker component, so network access to the device’s MQTT broker or a compromised local network node is necessary. Once the crafted message is received, the router will update its station list, which can be used to disrupt service or pivot to other components.