CVE-2025-29653: SQL Injection Vulnerability in TP-Link 4G LTE Mobile Wi-Fi Router Firmware

Overview

The cybersecurity world is faced with another significant vulnerability, CVE-2025-29653, which poses a severe threat to users of TP-Link M7450 4G LTE Mobile Wi-Fi Router Firmware Version: 1.0.2 Build 170306 Rel.1015n. This vulnerability, if exploited, allows an unauthenticated attacker to inject malicious SQL statements via the username and password fields. SQL injection is an attack technique that can manipulate database queries, potentially leading to data leakage, unauthorized access, or even total system compromise.
The high severity of this vulnerability is a call for immediate action by all users and administrators of the affected systems. If left unattended, this vulnerability could lead to serious business losses and severe reputational damage.

Vulnerability Summary

CVE ID: CVE-2025-29653
Severity: Critical (CVSS: 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Possible system compromise and data leakage

Affected Products

Product | Affected Versions

TP-Link M7450 4G LTE Mobile Wi-Fi Router | Firmware Version: 1.0.2 Build 170306 Rel.1015n

How the Exploit Works

The exploit works by an attacker injecting malicious SQL statements into the username or password fields of the TP-Link M7450 4G LTE Mobile Wi-Fi Router. Due to the SQL Injection vulnerability, the router’s firmware fails to properly sanitize user-supplied input. This failure allows an attacker to alter the structure of the SQL query and control its logic, potentially leading to unauthorized access or data leakage.

Conceptual Example Code

This conceptual code is an example of how an attacker might exploit this vulnerability. Note that this is not a real exploit but a representation of how the intrusion could occur.

POST /login HTTP/1.1
Host: tplink.router
Content-Type: application/x-www-form-urlencoded
username=admin' OR '1'='1'; --&password=admin

In the code snippet above, the attacker supplies a malicious payload into the `username` field. The payload `’ OR ‘1’=’1′; –` tricks the SQL query into always returning true, bypassing the authentication logic and potentially granting the attacker administrative access to the router.