Is there a public PoC exploit available for CVE-2025-7952?

Yes, a public proof-of-concept exploit is available for CVE-2025-7952. Prioritise patching immediately. EPSS: 3.0%.

TOTOLINK T6 CVE-2025-7952

Q: What is the CVSS score of CVE-2025-7952?

CVE-2025-7952 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 3.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-22 cna@vuldb.com

Command Injection T6 Firmware

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:29 vuln.today

DescriptionCVE.org

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Command injection in TOTOLINK T6 firmware 4.1.5cu.748 allows authenticated remote attackers to execute arbitrary commands via the ckeckKeepAlive function in the MQTT Packet Handler component (wireless.so). The vulnerability requires valid user credentials and network access but results only in low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the CVSS 2.1 score and EPSS 3.01% indicate low practical exploitation probability despite public disclosure.

Technical ContextAI

The vulnerability resides in the wireless.so shared library component responsible for MQTT packet handling within the TOTOLINK T6 router firmware. The ckeckKeepAlive function improperly validates or sanitizes user-supplied input related to MQTT keep-alive packets, allowing command injection (CWE-74: Improper Neutralization of Special Elements used in an Command). MQTT is a lightweight publish-subscribe messaging protocol commonly used in IoT devices for remote management and telemetry. The affected firmware version 4.1.5cu.748_b20211015 suggests this is a dated release; modern router administrative interfaces typically process MQTT commands with elevated privileges, making injection points in this handler a plausible attack vector if authenticated session compromise or credential theft precedes exploitation.

RemediationAI

Immediate action: upgrade TOTOLINK T6 firmware to a version released after October 15, 2021. Contact TOTOLINK support (https://www.totolink.net/) or check the device's firmware update interface for the latest available release, as no specific patched version number is published in available CVE records. Interim mitigations prior to patching: restrict network access to the TOTOLINK T6 management interface by disabling remote management features or implementing strict firewall rules to allow administrative access only from trusted internal networks; disable MQTT functionality if not actively required for the deployment; enforce strong authentication by changing default credentials and implementing access control lists at the network perimeter. Note that these mitigations do not eliminate the vulnerability but reduce attack surface - they carry the trade-off of reduced remote manageability and potential loss of MQTT-dependent IoT integration until patching is complete.