The vulnerable function, updatePriChannel, contains an access‑control flaw that lets an unauthenticated attacker send a specially crafted MQTT message to the cs_broker component. By doing so the attacker can trigger a scan and switch the mesh router’s primary channel. This unauthorized channel change can disrupt wireless communication, potentially leading to denial of service or a temporary loss of network connectivity for all connected devices.

Devices affected by this flaw are TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015. Only this specific build is known to contain the unprotected updatePriChannel handler; newer firmware releases may have already applied the fix.

The issue is exploitable over the network by any party that can reach the router’s MQTT broker, with no authentication required. Because the defect is a direct access‑control weakness, an attacker can immediately change channel settings. The CVSS score of 9.8 indicates critical severity. The EPSS score is less than 1%, indicating a very low but nonzero exploitation probability, and the flaw is not yet listed in the CISA KEV catalog.