CVE-2025-28135
Published: 27 March 2025
Summary
CVE-2025-28135 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Totolink A810R Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation directly addresses the buffer overflow in downloadFile.cgi by applying firmware patches or updates for the TOTOLINK A810R.
Information input validation enforces bounds checking on CGI parameters to prevent buffer overflows from malicious network inputs.
Memory protection safeguards like stack canaries and non-executable stacks mitigate exploitation of the buffer overflow leading to device crashes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated buffer overflow in web CGI component (downloadFile.cgi) of public-facing router enables exploitation of public-facing application for DoS impact.
NVD Description
TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi.
Deeper analysisAI
CVE-2025-28135 is a buffer overflow vulnerability, classified under CWE-121, affecting the TOTOLINK A810R router on firmware version V4.1.2cu.5182_B20201026. The flaw exists in the downloadFile.cgi component, as disclosed on March 27, 2025, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An unauthenticated remote attacker with network access to the device can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation results in a denial-of-service condition, causing high availability impact through device crash or disruption, while confidentiality and integrity remain unaffected.
Advisories and additional details are available in the following references: https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28135.md and https://sudsy-eyeliner-a59.notion.site/BufferOverflow-V4-1-2cu-5182_B20201026-19872b8cd95f80808902fac8449fee64.
Details
- CWE(s)