CVE-2025-28035

Summary

CVE-2025-28035 is a pre-authentication remote command execution vulnerability discovered in the setNoticeCfg function of firmware version V4.1.2cu.5182_B20201102 used by TOTOLINK A830R devices. An attacker can exploit this issue by manipulating the NoticeUrl parameter to execute arbitrary commands on the affected system before authentication is required. Successful exploitation could result in significant unauthorized access and potential data breaches. Users are strongly advised to install the latest security patches as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.