The vulnerability resides in the setElinkQosConfig function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015. It is an access‑control weakness (CWE‑284) that allows an unauthenticated attacker to send a crafted MQTT message to the cs_broker component and modify privileged QoS settings on the master device. This issue can lead to unauthorized changes to traffic prioritization, potentially degrading network performance or creating a denial‑of‑service condition for certain traffic classes.

Firmware version 4.1.5cu.748_B20211015 on TOTOLINK T6 routers is affected. The flaw is present only in this specific build, and impact is confined to devices running this firmware, possibly including other T6 variants that ship with the same build. No other TOTOLINK products or firmware versions are mentioned.

The flaw permits remote exploitation without authentication, relying on the device’s MQTT broker interface. Attackers could simply send a single crafted message over the network, which the device accepts and applies to its QoS configuration. The CVSS score is 7.5, indicating a high severity. The EPSS score is < 1%, and the issue is not listed in the CISA KEV catalog, but the lack of defenses, combined with the ability to modify QoS settings globally, implies a significant risk to availability for compromised networks.