PT-2025-16888 · Tp Link · Tp-Link M7650
The Veteran
·
Published
2025-04-10
·
Updated
2025-04-24
·
CVE-2025-29651
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
TP-Link M7650 4G LTE Mobile Wi-Fi Router Firmware version 1.0.7 Build 170623 Rel.1022n
Description
A SQL Injection vulnerability exists in the TP-Link M7650 4G LTE Mobile Wi-Fi Router Firmware, allowing an unauthenticated attacker to inject malicious SQL statements via the
username and password fields. Note that this issue is disputed as it can only be reproduced on a supplier-provided emulator where access control is intentionally absent for ease of functional testing.Recommendations
As a temporary workaround, consider disabling the login functionality that uses the
username and password fields until a patch is available. Restrict access to the router's web interface to minimize the risk of exploitation. Avoid using the username and password fields in the affected firmware version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tp-Link M7650