CVE-2025-28137

CVSS 9.8 CRITICALEPSS 10.3%CWE-78

Vexday Risk Score

53Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.8EPSS 10.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

15 Apr 2025Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 1

cve_referencesudsy-eyeliner-a59.notion.site/RCE1-1ab72b8cd95f80d09eded269810f3756unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28137.md https://sudsy-eyeliner-a59.notion.site/RCE1-1ab72b8cd95f80d09eded269810f3756 https://sudsy-eyeliner-a59.notion.site/RCE1-1ab72b8cd95f80d09eded269810f3756?pvs=4