CVE-2025-28034

Deeper analysis

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 contain a pre-authentication remote command execution flaw in the NTPSyncWithHost function that is triggered through the hostTime parameter. The issue is tracked as CVE-2025-28034 with a CVSS 3.1 base score of 9.8 and is classified under CWE-78 as an instance of OS command injection.

An unauthenticated attacker with network reachability to an affected device can supply a crafted hostTime value and execute arbitrary operating-system commands without any prior authentication or user interaction. Successful exploitation grants the attacker full control over the device, including the ability to read, modify, or delete data and to disrupt availability.

Public references consist of two detailed Notion pages that describe the vulnerability but do not reference vendor advisories, firmware updates, or mitigation steps. The EPSS score rose from a low baseline to a peak of 0.0636 on 2026-02-16 before receding to the current value of 0.0279, indicating a period of increased exploitation interest after disclosure.