CVE-2022-25131

Deeper analysis

A command injection vulnerability exists in the recvSlaveCloudCheckStatus function of certain TOTOLINK routers, specifically T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320. The flaw, tracked as CVE-2022-25131 and assigned CWE-77, permits unauthenticated attackers to inject and execute arbitrary operating system commands by sending a specially crafted MQTT packet. It carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required privileges or user interaction.

An attacker with network access to the router’s MQTT interface can exploit the issue to run commands with the privileges of the affected process, potentially leading to full device compromise including configuration changes, credential theft, or use as a pivot point within a target network.

Public references consist of a technical write-up on GitHub and an IBM X-Force entry; neither source describes vendor patches, firmware updates, or other mitigation steps.

EPSS for the CVE reached a peak of 0.0558 on 2025-01-22 before receding to the current value of 0.0446, indicating a modest post-disclosure increase in predicted exploitation interest.