CVE-2025-28138
Published: 27 March 2025
Summary
CVE-2025-28138 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink A800R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-28138 is a pre-authentication remote command execution vulnerability affecting the TOTOLINK A800R router running firmware version V4.1.2cu.5137_B20200730. The flaw resides in the setNoticeCfg function, where the NoticeUrl parameter is processed without adequate sanitization, enabling OS command injection as indicated by the associated CWE-78 classification. The issue carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction.
An unauthenticated remote attacker can supply a malicious NoticeUrl value to the affected endpoint and achieve arbitrary command execution on the device. Successful exploitation grants the attacker full control over the router, including the ability to read, modify, or delete data and disrupt device operation.
Public references consist of technical write-ups and proof-of-concept material hosted on GitHub and Notion; these sources do not include vendor advisories, firmware patches, or explicit mitigation guidance. The associated EPSS score rose from a low baseline to a peak of 0.0788 on 2026-02-03 before receding to its current value of 0.0379, indicating a period of increased exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8646
Vulnerability details
The TOTOLINK A800R V4.1.2cu.5137_B20200730 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Pre-auth RCE via OS command injection in public-facing router web interface directly enables T1190 for initial access and T1059.004 for Unix shell command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection by validating and sanitizing the NoticeUrl parameter in the setNoticeCfg function.
Requires timely remediation of the specific pre-auth RCE flaw in the router firmware to eliminate the vulnerability.
Enforces boundary protections to restrict network access to the vulnerable web management interface on the router.