Tp Link · Tp-Link M7000 · CVE-2025-29652
**Name of the Vulnerable Software and Affected Versions**
TP-Link M7000 4G LTE Mobile Wi-Fi Router Firmware version 1.0.7 Build 180127 Rel.55998n
**Description**
A SQL Injection vulnerability exists in the TP-Link M7000 4G LTE Mobile Wi-Fi Router Firmware, allowing an unauthenticated attacker to inject malicious SQL statements via the `username` and `password` fields. Note that this issue can only be reproduced on a supplier-provided emulator, where access control is intentionally absent for ease of functional testing.
**Recommendations**
As a temporary workaround, consider disabling the login functionality until a patch is available. Restrict access to the router's web interface to minimize the risk of exploitation. Avoid using the `username` and `password` fields in the affected firmware version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.