CVE-2025-28138
Published: 27 March 2025
Summary
CVE-2025-28138 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink A800R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by validating and sanitizing the NoticeUrl parameter in the setNoticeCfg function.
Requires timely remediation of the specific pre-auth RCE flaw in the router firmware to eliminate the vulnerability.
Enforces boundary protections to restrict network access to the vulnerable web management interface on the router.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Pre-auth RCE via OS command injection in public-facing router web interface directly enables T1190 for initial access and T1059.004 for Unix shell command execution.
NVD Description
The TOTOLINK A800R V4.1.2cu.5137_B20200730 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
Deeper analysisAI
CVE-2025-28138 is a pre-authentication remote command execution vulnerability affecting the TOTOLINK A800R router running firmware version V4.1.2cu.5137_B20200730. The flaw resides in the setNoticeCfg function, where the NoticeUrl parameter allows attackers to inject and execute arbitrary operating system commands, corresponding to CWE-78 (OS Command Injection). The vulnerability has a CVSS v3.1 base score of 9.8, reflecting its critical severity due to network accessibility and lack of prerequisites for exploitation.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants attackers the ability to execute arbitrary commands on the device, potentially achieving full compromise with high impacts on confidentiality, integrity, and availability, such as data theft, persistent access, or device disruption.
Details on exploitation, including proof-of-concepts, are documented in advisories available at https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28138.md and https://sudsy-eyeliner-a59.notion.site/RCE2-1ac72b8cd95f8055a76ee0ca262aac1a?pvs=4. No specific patch or mitigation guidance is detailed in the provided CVE information.
Details
- CWE(s)