CVE-2025-28037

Summary

CVE-2025-28037 is a pre-authentication remote command execution vulnerability affecting the setDiagnosisCfg function in TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 firmware. An attacker can exploit this issue by manipulating the ipDomain parameter to execute arbitrary commands on the targeted device, gaining unauthorized access and control. Successful exploitation could result in significant harm, including data theft, system compromise, or unauthorized network access. Users are strongly advised to update their firmware to the latest versions as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.