CVE-2025-7952

low · 2.1

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

2.1

CVSS

18.2%

EPSS (exploit prob.)

97th

EPSS percentile

2025-07-22

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-74CWE-77

Affected products

Vendor	Product	Affected versions
totolink	t6_firmware	v4.1.5cu.748_b20211015
totolink	t6	3

Check a specific version with /api/v1/cve/match.

References

https://github.com/ElvisBlue/Public/blob/main/Vuln/7.md
https://github.com/ElvisBlue/Public/blob/main/Vuln/7.md#poc
https://vuldb.com/?ctiid.317098
https://vuldb.com/?id.317098
https://vuldb.com/?submit.619319
https://www.totolink.net/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-7952