PT-2025-16889 · Tp Link · Tp-Link M7000
The Veteran
·
Published
2025-04-10
·
Updated
2025-04-24
·
CVE-2025-29652
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
TP-Link M7000 4G LTE Mobile Wi-Fi Router Firmware version 1.0.7 Build 180127 Rel.55998n
Description
A SQL Injection vulnerability exists in the TP-Link M7000 4G LTE Mobile Wi-Fi Router Firmware, allowing an unauthenticated attacker to inject malicious SQL statements via the
username and password fields. Note that this issue can only be reproduced on a supplier-provided emulator, where access control is intentionally absent for ease of functional testing.Recommendations
As a temporary workaround, consider disabling the login functionality until a patch is available. Restrict access to the router's web interface to minimize the risk of exploitation. Avoid using the
username and password fields in the affected firmware version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tp-Link M7000