TP-Link M7000 4G LTE Mobile Wi-Fi Router SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the TP-Link M7000 4G LTE Mobile Wi-Fi Router, specifically in Firmware Version 1.0.7 Build 180127 Rel.55998n. This vulnerability allows an unauthenticated attacker to inject malicious SQL statements through the username and password fields. However, it is important to note that this issue can only be reproduced on a supplier-provided emulator, where access control is intentionally absent to facilitate functional testing.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could potentially lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.