CVE-2025-7837
Published: 19 July 2025
Summary
CVE-2025-7837 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink T6 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-7837 is a critical buffer overflow vulnerability affecting the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. The issue resides in the recvSlaveStaInfo function of the MQTT Service component, where manipulation of the 'dest' argument triggers the overflow. It is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling remote exploitation over the network with low attack complexity by an attacker possessing low privileges. Successful exploitation could grant high impacts on confidentiality, integrity, and availability, likely allowing arbitrary code execution on the affected device.
References point to a GitHub repository containing details and a proof-of-concept for the exploit, along with VulDB entries documenting the issue. No vendor advisories or patches are specified in the available information, though the public disclosure of the exploit heightens the risk of active attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21970
Vulnerability details
A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this issue is the function recvSlaveStaInfo of the component MQTT Service. The manipulation of the argument dest leads to buffer overflow. The attack may be launched…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote buffer overflow in the MQTT service of the TOTOLINK T6 router enables exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents buffer overflows by requiring validation of inputs like the manipulated 'dest' argument in the recvSlaveStaInfo MQTT function.
Addresses the root flaw remediation by establishing processes to identify, prioritize, and patch vulnerabilities like this buffer overflow in router firmware.
Implements memory safeguards such as DEP and ASLR to block unauthorized code execution resulting from the buffer overflow exploitation.