TOTOLINK T6 CVE-2025-7952

Exploitation requires the attacker to possess valid authenticated access to the TOTOLINK T6 router (PR:L in CVSS vector indicates low-privilege user authentication). This means either compromised Wi-Fi network password, stolen administrative login credentials, or leveraging a user session on the same network. The MQTT Packet Handler (wireless.so) must be active and processing ckeckKeepAlive packets - typically enabled by default on TOTOLINK routers for remote management, but may be disabled in hardened configurations. The vulnerability does NOT require special device configuration or feature enablement beyond normal router operation. Remote unauthenticated attackers cannot directly exploit this; it is strictly a post-authentication vulnerability. The attack complexity is low (AC:L), meaning no special timing, race conditions, or version-specific bypasses are required once authenticated access is obtained.

This vulnerability presents a conflicted risk profile. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) indicates network-remote exploitation requiring low-privileged authentication with no user interaction - normally a concerning posture. However, multiple signals reduce real-world urgency: CVSS score of only 2.1 severely constrains impact (VC:L/VI:L/VA:L with no scope increase), EPSS 3.01% places it in the 87th percentile (low exploitation likelihood), and no CISA KEV listing despite public POC availability suggests either limited exploitation attempts or successful vendor mitigation via defaults. The E:P (Exploit Proof-of-Concept) indicator confirms public code exists but does not indicate active wild exploitation. Organizations running TOTOLINK T6 firmware v4.1.5cu.748 should patch, but this is not a critical incident response priority compared to high-impact vulnerabilities. The primary risk is to users with weak authentication hygiene or users on firmware versions with MQTT interfaces exposed to untrusted networks.

An authenticated attacker (e.g., via compromised Wi-Fi credentials or stolen login token) connects to the TOTOLINK T6 router's management interface and sends a specially crafted MQTT keep-alive packet to the ckeckKeepAlive function containing shell metacharacters or command substitution syntax. The vulnerable code fails to sanitize this input and executes the injected command with the privileges of the wireless.so process, potentially allowing information disclosure or minor system manipulation. Publicly available exploit code on GitHub documents the exact packet structure needed.