CVE-2025-7952
Published: 22 July 2025
Summary
CVE-2025-7952 is a low-severity Injection (CWE-74) vulnerability in Totolink T6 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A critical command injection vulnerability exists in the ckeckKeepAlive function within the wireless.so component of the MQTT Packet Handler on TOTOLINK T6 firmware version 4.1.5cu.748. The flaw stems from improper handling of input in this function, classified under CWE-74 and CWE-77, and permits remote attackers to inject and execute arbitrary commands.
An authenticated remote attacker can initiate the attack over the network without user interaction, achieving limited effects on confidentiality, integrity, and availability as reflected in the CVSS 4.0 score of 2.1. Public proof-of-concept code has been released, enabling potential reuse by threat actors with low privileges.
No official patches or mitigation guidance appear in the referenced disclosures. The EPSS score remains flat at 0.0761 with no material increase since publication, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22280
Vulnerability details
A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The…
more
exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote command injection in public-facing MQTT handler directly enables T1190 for initial access and T1059.004 for Unix shell command execution on the router firmware.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks command injection in ckeckKeepAlive by validating/sanitizing all MQTT packet inputs before they reach the wireless.so handler.
Requires prompt application of vendor patches or firmware updates that eliminate the publicly disclosed command-injection flaw in the MQTT component.
Disables or restricts the unnecessary MQTT Packet Handler (and wireless.so functions) to reduce the exposed attack surface on the TOTOLINK device.