PT-2022-17092 · Totolink Technology · Totolink T6

Published 2022-02-18 · Updated 2022-02-28 · CVE-2022-25135

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK Technology router T6 V3 Firmware version T6 V3 V4.1.5cu.748 B20211015

Description A command injection issue in the recv mesh info sync function allows attackers to execute arbitrary commands via a crafted MQTT packet. This can be exploited by sending a specially crafted packet to the vulnerable function, potentially leading to unauthorized access and control.

Recommendations For TOTOLINK Technology router T6 V3 Firmware version T6 V3 V4.1.5cu.748 B20211015, consider disabling the recv mesh info sync function until a patch is available to prevent exploitation via crafted MQTT packets. Restrict access to the MQTT endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2022-25135

Affected Products

Totolink T6

References · 6

• https://osv.dev/vulnerability/CVE-2022-25135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25135 · Security Note
• https://t.me/cibsecurity/37808 · Telegram Post
• https://t.me/cvenotify/27038 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-2022-25135 · Note
• ❌ https://github.com/pjqwudi1/my_vuln/blob/main/totolink/vuln_19/19.md · Note, Deleted