CVE-2022-25135

Deeper analysis

A command injection vulnerability tracked as CVE-2022-25135 affects the recv_mesh_info_sync function in TOTOLINK T6 V3 routers running firmware version T6_V3_V4.1.5cu.748_B20211015. The flaw, assigned CWE-77, permits arbitrary command execution when the device processes a specially crafted MQTT packet. It carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required authentication or user interaction.

An unauthenticated attacker with network access to the router can send a malicious MQTT message that reaches the affected function, resulting in execution of attacker-supplied commands. Successful exploitation grants full control over the device, including the ability to read or modify configuration, intercept traffic, or use the router as a pivot point inside the target network.

Public references consist of a detailed vulnerability report containing proof-of-concept material and an IBM X-Force vulnerability entry; neither source describes vendor patches, firmware updates, or recommended mitigations.

EPSS scores for the CVE have remained low, reaching a peak of 0.0558 in January 2025 before receding to the current value of 0.0446. No information on observed in-the-wild exploitation is provided in the available data.