Overview
The vulnerability identified as CVE-2025-29652 is a critical SQL Injection vulnerability that affects the TP-Link M7000 4G LTE Mobile Wi-Fi Router Firmware Version: 1.0.7 Build 180127 Rel.55998n. The vulnerability allows an unauthenticated attacker to inject malicious SQL statements via the username and password fields. This vulnerability is particularly concerning due to its potential to compromise the system or leak data. Considering the widespread usage of TP-Link mobile Wi-Fi routers, this vulnerability could potentially affect a significant number of users and their data.
Vulnerability Summary
CVE ID: CVE-2025-29652
Severity: Critical (CVSS: 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise and data leakage
Affected Products
No phone number, email, or personal info required.
Product | Affected Versions
TP-Link M7000 4G LTE Mobile Wi-Fi Router Firmware | Version: 1.0.7 Build 180127 Rel.55998n
How the Exploit Works
The vulnerability exploits the lack of proper input validation on the username and password fields of the TP-Link M7000 4G LTE Mobile Wi-Fi Router’s firmware interface. An attacker can inject malicious SQL commands into these fields, which are then processed by the underlying SQL database. This allows the attacker to manipulate the database, potentially gaining unauthorized access to the system or leaking sensitive data.
Conceptual Example Code
Here’s a conceptual example of how the vulnerability might be exploited. This is a sample HTTP POST request that an attacker might use to inject malicious SQL commands:
POST /login HTTP/1.1
Host: tplinkm7000.router
Content-Type: application/x-www-form-urlencoded
username=admin'; DROP TABLE users;--&password=In this example, the attacker submits a username of “admin’; DROP TABLE users;–“. This is a classic SQL injection attack that instructs the database to drop (delete) the “users” table, potentially causing significant disruption.