PT-2025-30935 · Totolink · Totolink T6

Reisen_1943 · Published 2025-07-25 · Updated 2025-07-26 · CVE-2025-8170

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015

Description A critical vulnerability exists in the MQTT Packet Handler component of the affected product. The vulnerability is due to a buffer overflow in the tcpcheck net function within the /router/meshSlaveDlfw file. This issue can be exploited remotely by manipulating the serverIp argument. The exploit for this vulnerability has been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2025-10029

CVE-2025-8170

Affected Products

Totolink T6

References · 12

• 🔥 https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/9.md · Exploit
• 🔥 https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/9.md#poc · Exploit
• https://bdu.fstec.ru/vul/2025-10029 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8170 · Security Note
• https://twitter.com/CveFindCom/status/1948853159922663589 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1948956530138648644 · Twitter Post
• https://vuldb.com/?submit.620834 · Note
• https://twitter.com/CVEnew/status/1948859485042450457 · Twitter Post
• https://totolink.net · Note
• https://vuldb.com/?ctiid.317584 · Note
• https://vuldb.com/?id.317584 · Note