CVE-2022-25130

Deeper analysis

A command injection vulnerability tracked as CVE-2022-25130 affects the updateWifiInfo function in TOTOLINK T6 V3 routers running firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2 routers running V4.1.8cu.5207_B20210320. The flaw, assigned CWE-77, permits arbitrary command execution when the device processes a specially crafted MQTT packet. It carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required authentication or user interaction.

An unauthenticated remote attacker can send a malicious MQTT message to the router and obtain full command execution on the device, resulting in complete compromise of confidentiality, integrity, and availability. The attack requires only network reachability to the router’s MQTT service.

Public references consist of a technical write-up and proof-of-concept on GitHub together with an IBM X-Force entry; none of the listed sources describe vendor patches, firmware updates, or recommended mitigations. The associated EPSS score has remained low, reaching a peak of 0.0558 in January 2025 before receding to 0.0446, indicating limited observed exploitation interest since disclosure.