CVE-2025-28036

Summary

CVE-2025-28036 is a pre-authentication remote command execution vulnerability affecting the TOTOLINK A950RG V4.1.2cu.5161_B20200903 firmware. The issue is located in the setNoticeCfg function, which can be exploited by an attacker through the NoticeUrl parameter, allowing them to execute arbitrary commands on the targeted device before authentication is required. Successful exploitation of this vulnerability could result in significant unauthorized access and potential data breaches. Users are advised to apply the necessary security patches promptly to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.