CVE-2022-25136

Deeper analysis

A command injection vulnerability tracked as CVE-2022-25136 affects the meshSlaveUpdate function in TOTOLINK T6 V3 routers running firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2 routers running firmware V4.1.8cu.5207_B20210320. The flaw, assigned CWE-77, permits unauthenticated remote attackers to inject and execute arbitrary operating-system commands by sending a specially crafted MQTT packet to the device.

An attacker with network access to an affected router can exploit the issue without authentication or user interaction, achieving full control over the device including the ability to read, modify, or delete data and potentially pivot to other systems on the network. The vulnerability carries a CVSS 3.1 base score of 9.8, reflecting its critical severity and the absence of required privileges or complexity.

Public references consist primarily of a technical write-up and proof-of-concept description hosted on GitHub together with an IBM X-Force entry; no vendor advisory or firmware patch information is provided in the available sources. The associated EPSS score has remained low, reaching a modest peak of 0.0558 in January 2025 before receding to the current value of 0.0446.