CVE-2022-25137: Command Injection
A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3Firmware T6V3V4.1.5cu.748B20211015 and T10 V2Firmware V4.1.8cu.5207B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25137?
CVE-2022-25137 is classified as a high severity command injection vulnerability.
How do I fix CVE-2022-25137?
To mitigate CVE-2022-25137, update the affected TOTOLINK firmware to the latest version provided by the manufacturer.
Which devices are affected by CVE-2022-25137?
CVE-2022-25137 affects TOTOLINK T6 devices with firmware version v4.1.5cu.748_B20211015 and T10 devices with firmware version v4.1.8cu.5207_B20210320.
What kind of attack can exploit CVE-2022-25137?
An attacker can exploit CVE-2022-25137 to execute arbitrary commands through a crafted MQTT packet.
Is CVE-2022-25137 being actively exploited?
There are no public indications of active exploitation for CVE-2022-25137, but the vulnerability remains a significant risk without mitigation.